Threats tagged 'ghsa-j64q-jhwc-69jc'

CVE-2026-63587 is an authentication bypass vulnerability in the Weidmueller IE-SR-2TX-WL-4G-EU device's SMS control function. The device can be configured to require a password for SMS commands, with a retry counter that disables password authorization after 5 failed attempts. An unauthenticated attacker can exploit this by sending 5 invalid SMS password attempts, causing the device to disable password checks and accept subsequent SMS commands without authentication. This can lead to limited configuration tampering, information leakage, and potentially full loss of availability. The vulnerability affects version 1.67 of the device firmware. No patch or official remediation is currently available. The CVSS 4.0 score is 8.8, indicating high severity.