| Publisher: Weidmueller Interface GmbH & Co. KG | Document category: csaf_security_advisory |
| Initial release date: 2026-07-28T09:00:00.000Z | Engine: Secvisogram 2.6.4 |
| Current release date: 2026-07-28T09:00:00.000Z | Build Date: 2026-07-23T09:35:33.641Z |
| Current version: 1.0.0 | Status: final |
| CVSSv3.1 Base Score: 8.8 | Severity: High |
| Original language: | Language: en-GB |
| Also referred to: VDE-2026-081, WMSA-2600004 | |
Weidmueller security routers IE-SR-4TX and IE-SR-4GT are affected by multiple vulnerabilities (CVE-2026-14167, CVE-2026-14168, CVE-2026-14169, CVE-2026-14171, CVE-2026-2291, CVE-2026-4893, CVE-2026-5172, CVE-2026-40510, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796) in firmware releases prior to V2.3.0 authorization, robustness and redirect flaws in the proprietary configuration interface and web UI, and multiple vulnerabilities in the bundled third-party components dnsmasq, OpenSC and OpenSSL. All are fixed in firmware V2.3.0.
As a general security measure, Weidmueller strongly recommends to change the default passwords and to minimize the network exposure of products. Limit access to trusted networks by using the appropriate mechanisms.
Depending on the flaw, an authenticated user can escalate to administrator privileges, lock out a user account or crash the configuration service and a post-login redirect enables phishing. The bundled third-party components add DNS cache-poisoning / denial of service (dnsmasq), a physical-access smart-card stack overflow (OpenSC) and denial-of-service issues in OpenSSL reachable only by locally parsing crafted PKCS#12/PKCS#7/timestamp input.
Update to the new version as listed in the following table:
| Product | Article Number | Firmware File Name | Affected Version | Fixed Version |
|---|---|---|---|---|
| IE-SR-4TX | 2751270000 | Firmware_IE-SR-4TX_series | <V2.3.0 | V2.3.0 |
| IE-SR-4TX-LTE/4G-EU | 2751280000 | Firmware_IE-SR-4TX_series | <V2.3.0 | V2.3.0 |
| IE-SR-4TX-LTE/4G-USEMEA | 2739630000 | Firmware_IE-SR-4TX_series | <V2.3.0 | V2.3.0 |
| IE-SR-4GT | 2873910000 | Firmware_IE-SR-4GT_series | <V2.3.0 | V2.3.0 |
| IE-SR-4GT-LTE/4G-EU | 2873920000 | Firmware_IE-SR-4GT_series | <V2.3.0 | V2.3.0 |
| IE-SR-4GT-LTE/4G-USEMEA | 2873930000 | Firmware_IE-SR-4GT_series | <V2.3.0 | V2.3.0 |
A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization.
| CVSS Score: | 8.8 (HIGH) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|---|---|
| CWE: | CWE-863: Incorrect Authorization |
Known affected
Fixed
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.
| CVSS Score: | 8.8 (HIGH) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|---|---|
| CWE: | CWE-862: Missing Authorization |
Known affected
Fixed
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.
| CVSS Score: | 8.1 (HIGH) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
|---|---|
| CWE: | CWE-696: Incorrect Behavior Order |
Known affected
Fixed
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability.
| CVSS Score: | 6.1 (MEDIUM) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|---|---|
| CWE: | CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
Known affected
Fixed
Restrict access to the configuration interface / web UI to trusted administrators and trusted networks, and do not grant the user/permission-management write permission to non-administrator roles.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.
| CVSS Score: | 7.3 (HIGH) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
|---|---|
| CWE: | CWE-190: Integer Overflow or Wraparound |
Known affected
Fixed
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 client subnet information.
| CVSS Score: | 5.3 (MEDIUM) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|---|---|
| CWE: | CWE-287: Improper Authentication |
Known affected
Fixed
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
A buffer overflow in dnsmasq's extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting a malformed DNS response, enabling extract_name() to advance the pointer past the record's end.
| CVSS Score: | 7.3 (HIGH) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
|---|---|
| CWE: | CWE-125: Out-of-bounds Read |
Known affected
Fixed
Set the DNS proxy to disabled; this closes the DNS port and renders the issue unreachable.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.
| CVSS Score: | 3.8 (LOW) - CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L |
|---|---|
| CWE: | CWE-121: Stack-based Buffer Overflow |
Known affected
Fixed
Exploitation requires physical access. Restrict physical access to the device and to its USB and smart-card interfaces, and do not connect untrusted PIV smart cards or CCID/USB devices.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write.
Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application.
The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. Exploitation requires an application that explicitly uses this filter with a BIO chain that can short-write and that writes large, newline-free data influenced by an attacker.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
| CVSS Score: | 4.7 (MEDIUM) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
|---|---|
| CWE: | CWE-787: Out-of-bounds Write |
Known affected
Fixed
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
Issue summary: When using the low-level OCB API directly with AES-NI or other hardware-accelerated code paths, inputs whose length is not a multiple of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in cleartext on encryption and are not covered by the authentication tag, allowing an attacker to read or tamper with those bytes without detection.
Typical OpenSSL consumers using the EVP API are not affected because the higher-level EVP and provider OCB implementations process full and partial blocks separately. TLS does not use OCB ciphersuites. Only applications that call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with non-block-aligned lengths on hardware-accelerated builds are affected.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected.
| CVSS Score: | 4 (MEDIUM) - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
|---|---|
| CWE: | CWE-325: Missing Cryptographic Step |
Known affected
Fixed
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer.
Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service.
The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected.
| CVSS Score: | 7.4 (HIGH) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
|---|---|
| CWE: | CWE-787: Out-of-bounds Write |
Known affected
Fixed
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file.
Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service.
Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected.
| CVSS Score: | 7.5 (HIGH) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|---|---|
| CWE: | CWE-754: Improper Check for Unusual or Exceptional Conditions |
Known affected
Fixed
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function.
Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files.
The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
| CVSS Score: | 7.5 (HIGH) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|---|---|
| CWE: | CWE-476: NULL Pointer Dereference |
Known affected
Fixed
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file.
Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service.
A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read constrained to a 1-byte address space, which reliably results in a crash on most modern operating systems.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected.
| CVSS Score: | 5.5 (MEDIUM) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
|---|---|
| CWE: | CWE-754: Improper Check for Unusual or Exceptional Conditions |
Known affected
Fixed
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data.
Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service.
Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
| CVSS Score: | 5.3 (MEDIUM) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|---|---|
| CWE: | CWE-754: Improper Check for Unusual or Exceptional Conditions |
Known affected
Fixed
Exploitation requires locally parsing crafted input (e.g. importing a malicious PKCS#12, PKCS#7 or RFC 3161 timestamp file); not reachable during the TLS handshake. Impact is denial of service only. Do not import or parse untrusted files of these types.
Update to firmware IE-SR-4TX V2.3.0, IE-SR-4GT V2.3.0 or later.
References
Namespace: https://www.weidmueller.com
psirt@weidmueller.com
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1.0.0 | 2026-07-28T09:00:00.000Z | Initial version |
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/