Weidmueller IE-SR-2TX Security Routers Command Injection Vulnerability Allowing Elevated Privilege Execution

A command injection vulnerability has been identified in Weidmueller security routers IE-SR-2TX models, including the IE-SR-2TX-WL, IE-SR-2TX-WL-4G-EU, and IE-SR-2TX-WL-4G-US-V versions, all prior to specific fixed releases. This vulnerability allows an unauthenticated remote attacker, positioned as a man-in-the-middle, to inject arbitrary commands into responses from WWH servers, potentially leading to unauthorized command execution with elevated privileges on the affected devices.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected router with root privileges.

Remediation

Users are advised to update to version 1.49 for the IE-SR-2TX-WL model and version 1.62 for the IE-SR-2TX-WL-4G-EU and IE-SR-2TX-WL-4G-US-V models.