CVE-2026-63587: falha de alta gravidade em Weidmueller Interface IE-SR-2TX-WL-4G-EU
SMS Password Authorization Bypass via Failed Attempt Counter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.4%
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliberately trigger this by submitting 5 or more invalid passwords, after which subsequent SMS commands are executed without requiring a password, resulting in potential limited configuration tampering, limited information leakage and potentially full loss of availability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Weidmueller Interface · IE-SR-2TX-WL-4G-EUWeidmueller Interface · IE-SR-2TX-WL-4G-US-VCVEs relacionadas — Weidmueller Interface IE-SR-2TX-WL-4G-EU
No mesmo produto, das mais perigosas para as menos.