Overview
A critical unauthenticated remote code execution vulnerability has been disclosed in Weidmueller IE-SR-2TX-WL industrial security routers and their 4G variants. Tracked as CVE-2026-63586, the flaw lives in the device's web-based management interface, which runs a modified uhttpd server backed by CGI shell scripts. The HTTP Basic Authentication username — taken directly from the request's Authorization header — is inserted, unsanitized, into a shell command string executed via system().
An attacker who sends a specially crafted username containing shell metacharacters can escape the intended command context and execute arbitrary commands as root, without ever supplying a valid password or authenticating at all.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-63586 |
| CVSS Score | 9.8 (Critical) |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | None |
| CWE | CWE-78 (OS Command Injection) |
| Vendor Advisory | CERT@VDE VDE-2026-083 |
| Disclosed | 2026-08-25 |
Root Cause
The router's web management CGI handler builds a shell command string that embeds the HTTP Basic Auth username verbatim before executing it with system(). Because the username field is never sanitized or escaped, shell metacharacters (;, `, $(), |) supplied in the Authorization header are interpreted by the shell rather than treated as literal text. No valid credentials are required — the malicious payload is delivered in the same header used to attempt authentication, so the command executes before any credential check meaningfully gates access.
Affected Products
| Model | Affected Firmware |
|---|---|
| IE-SR-2TX-WL (2682590000) | 1.52 up to (but not including) 1.57 |
| IE-SR-2TX-WL-4G-EU (2682560000) | 1.67 up to (but not including) 1.74 |
| IE-SR-2TX-WL-4G-US-V (2682580000) | 1.67 up to (but not including) 1.74 |
A companion flaw, CVE-2026-63587 (CVSS 8.6), affects the 4G variants: their SMS-based password recovery/authorization mechanism can be bypassed after five failed authentication attempts, an alternate-path authentication bypass (CWE-288).
Impact Assessment
These routers are marketed as industrial security routers — deployed at the network edge of OT/ICS environments to segment and protect PLCs, HMIs, and other industrial control equipment behind a VPN/firewall gateway. A root-level RCE in the device guarding that boundary is a full perimeter breach:
- Complete device takeover — root shell access allows the attacker to read/modify firewall rules, VPN configuration, and routing tables
- Pivot point into OT networks — the router sits between the internet/corporate network and the industrial control segment it was deployed to protect
- Persistence — root access enables planting of backdoors that survive reboots (as seen with similar CGI-based command injection flaws in embedded Linux routers)
- No authentication barrier — the attacker needs no valid credentials, only network reachability to the management interface
Who Is at Risk
Any organization running an unpatched IE-SR-2TX-WL series router with its web management interface reachable from an untrusted network — including exposure to the public internet, a shared vendor/remote-access VPN, or a flat internal network without segmentation.
Mitigation
Immediate Actions
- Restrict access to the management interface. Weidmueller advises limiting exposure via firewall rules, access control lists (ACLs), a dedicated VPN, or a trusted management network — do not expose the web UI to the internet or untrusted segments.
- Apply the vendor firmware update referenced in CERT@VDE advisory VDE-2026-083 as soon as it is validated for your deployment. Contact Weidmueller support/PSIRT for the specific patched build for your model.
- Disable SMS control message reception on 4G-equipped units (IE-SR-2TX-WL-4G-EU / -US-V) to close the CVE-2026-63587 bypass path while patching is scheduled.
- Audit for indicators of compromise — review router logs for unexpected
system()/CGI invocations, unfamiliar processes, or configuration changes since firmware 1.52 (or 1.67 for 4G models) was deployed.
Detection Guidance
Because exploitation rides inside the Authorization: Basic header, standard web server access logs (if enabled on the device) should be checked for base64-encoded Basic Auth strings that decode to usernames containing shell metacharacters (;, `, $(, |, &&). Devices exposing management interfaces to the internet should be treated as compromised pending investigation.