What’s Vulnerable › Vulnerabilities

CVE-2025-41663: Weidmueller: Security routers IE-SR-2TX are affected by Command Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-11 · updated 2026-06-17
• Weakness: CWE-78

Description

For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers, which are then executed with elevated privileges. To get into such a position, clients would need to use insecure proxy configurations.

Affected products

• Weidmueller IE-SR-2TX-WL: before V1.49 — fixed in V1.49
• Weidmueller IE-SR-2TX-WL-4G-EU: before V1.62 — fixed in V1.62
• Weidmueller IE-SR-2TX-WL-4G-US-V: before V1.62 — fixed in V1.62

How to fix

Upgrade to a fixed version: Weidmueller IE-SR-2TX-WL V1.49; Weidmueller IE-SR-2TX-WL-4G-EU V1.62; Weidmueller IE-SR-2TX-WL-4G-US-V V1.62. Check the vendor advisory for mitigations.

References

• https://certvde.com/en/advisories/VDE-2025-052

Get alerted when CVE-2025-41663 or the next vulnerability affects your stack