A critical command injection flaw (CVSS 9.8) in the web management interface of several Weidmueller IE-SR industrial routers lets an unauthenticated network attacker execute arbitrary commands as root.
What Is It
The flaw is in how the devices' web management interface handles HTTP Basic Authentication credentials. Based on the advisory description, the username value supplied in the Authorization header reaches an OS command interpreter without adequate sanitization. The specific implementation internals, which component invokes the interpreter and how, have not been detailed by the vendor in the supplied data.
What is established is the effect: an attacker who submits a username containing shell metacharacters can escape the intended command context. No credentials are needed; the injection occurs during authentication handling, before any credential check succeeds. The result is arbitrary command execution with root privileges.
This is tracked as CWE-78 (OS Command Injection). CVSS v3.1 base score is 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the CVSS v4.0 score assigned by CERT@VDE is 9.3 CRITICAL.
Why It Matters
Every exploitability factor is at its worst value: network attack vector, low complexity, no privileges, no user interaction. Confidentiality, integrity, and availability impacts are all HIGH. A single crafted HTTP request against an exposed management interface yields full root control of the device.
These are industrial routers; devices that typically sit at the boundary of OT networks, including cellular-connected 4G variants. Root on the router means control of the traffic crossing it.
CISA KEV does not currently list this CVE, and no confirmed active exploitation is reported in the supplied data. CVSS v4.0 exploit maturity is NOT_DEFINED.
What's Vulnerable
Vendor: Weidmueller Interface
| Product | Affected versions |
|---|---|
| IE-SR-2TX-WL | 1.52 up to (not including) 1.57 |
| IE-SR-2TX-WL-4G-EU | 1.67 up to (not including) 1.74 |
| IE-SR-2TX-WL-4G-US-V | 1.67 up to (not including) 1.74 |
All other versions are listed as unaffected by default.
Patch Status
Fixed firmware versions are indicated by the affected ranges: 1.57 for IE-SR-2TX-WL, and 1.74 for the IE-SR-2TX-WL-4G-EU and IE-SR-2TX-WL-4G-US-V models. Upgrade to at least these versions. The record was published 2026-08-25 and its NVD status is still "Received," so enrichment may change. Consult CERT@VDE advisory VDE-2026-083 for vendor remediation guidance; no specific required-action deadline is present in the supplied data.
Sources
- NVD, CVE-2026-63586: https://nvd.nist.gov/vuln/detail/CVE-2026-63586
- CERT@VDE Advisory VDE-2026-083: https://www.certvde.com/en/advisories/VDE-2026-083/