Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface

CVE-2026-63586 is an OS command injection in the web management interface of Weidmueller IE-SR-2TX-WL series industrial security routers. The device takes the username from an HTTP Basic Authentication header and concatenates it directly into a shell command passed to system() — no sanitization, no escaping, no authentication check first. An attacker sends a single HTTP request with shell metacharacters (e.g. $(id) or ;cat /etc/shadow;) in the username field and gets root-level command execution. Affected versions: IE-SR-2TX-WL firmware 1.52 to <1.57, IE-SR-2TX-WL-4G-EU and IE-SR-2TX-WL-4G-US-V firmware 1.67 to <1.74. Fixed in v1.57 and v1.74 respectively.

The vendor's CRITICAL rating (CVSS 4.0: 9.3 / CVSS 3.1: 9.8) is entirely justified and if anything understates the operational risk. These are not commodity web apps — they are industrial security routers that sit at the boundary between enterprise/internet networks and OT/ICS segments. The 4G variants are designed for remote cellular connectivity, meaning some percentage are directly reachable from the internet without any intervening firewall. The trivial exploitation bar (one HTTP request, no credentials needed, instant root) combined with the OT-gateway role makes this a textbook network-perimeter-to-plant-floor kill chain.

Why this verdict

• Exploitation trivially simple: Single HTTP request with shell metacharacters in the Basic Auth username. No credentials, no interaction, no chaining required. The system() sink with unsanitized input is about as bad as command injection gets.
• Role multiplier: The IE-SR-2TX-WL is *exclusively* deployed as a network edge appliance and OT/ICS security gateway. It is the defined security boundary between enterprise/internet zones and industrial control systems. Compromise of this device = direct L2/L3 access to PLCs, HMIs, SCADA systems. Blast radius is OT-safety-scale — the chain succeeds in 100% of deployment roles because there is only one role. Per the high-value role floor rule, this forces a CRITICAL floor.
• 4G variants increase exposure: The IE-SR-2TX-WL-4G-EU and -4G-US-V models are designed for remote cellular connectivity. These devices may have their management interfaces directly reachable over public cellular IPs without intervening firewalls, expanding the attack surface beyond LAN-only scenarios.
• No authentication barrier whatsoever: The injection fires during the *parsing* phase of HTTP Basic Auth — before any credential validation. The device does not need to have weak or default credentials; the vulnerability bypasses the authentication mechanism entirely.

Why not higher?

The vendor already rates this at the ceiling of their CVSS scale (9.3 / 9.8). There is no higher bucket than CRITICAL. The score of 9.3 (CVSS 4.0) is appropriate; the only missing element preventing a perfect 10.0 is the lack of Subsequent system scope impact in the CVSS 4.0 vector, which is debatable given the OT pivot potential.

Why not lower?

Downgrading would require evidence that the management interface is systematically unreachable in real deployments. The 4G variants are *designed* for remote/cellular access, making network reachability a feature rather than an accident. The device occupies a high-value OT gateway role by definition — not as a minority use case but as its *sole purpose*. The zero-friction, zero-auth attack chain provides no compounding downward pressure. Even the small installed base does not help defenders who *do* run these devices; severity is about impact to the affected organization, not population share.

1. Block or ACL-restrict the web management interface immediately — Use upstream firewall rules to restrict HTTP/HTTPS access to the router's management IP to a jump host or dedicated management VLAN only. On the 4G variants, disable the web interface on the cellular WAN interface if the device supports interface-specific binding. Deploy within 3 days per noisgate mitigation SLA for CRITICAL.
2. Disable HTTP and force HTTPS-only if you must keep the web interface open — While this does not fix the injection, it reduces the attack surface from opportunistic scanners and ensures TLS wrapping. Some network IDS can inspect TLS-decrypted traffic for malicious auth headers.
3. Deploy OT network monitoring on the protected segment — Tools like Claroty, Nozomi Networks, or Dragos can detect anomalous traffic originating from the gateway router's internal IP, providing a detection backstop if the router is compromised. Deploy or tune existing OT monitoring within 3 days.
4. Apply firmware updates (v1.57 / v1.74) on an emergency schedule — This is the definitive fix. OT firmware updates require maintenance windows and validation — begin scheduling immediately. Target completion within the noisgate remediation SLA of 90 days, but given the trivial exploitation, aim for the fastest window your change management allows.
5. Audit for companion CVE-2026-63587 on 4G variants — The same advisory discloses an SMS-based authentication bypass (CVSS 8.6) on 4G models. Disable SMS message reception on affected devices as an interim control.

Run this script from any Linux/macOS host with network access to the Weidmueller router's management interface. Usage: bash check_cve_2026_63586.sh <router-ip> [port]. No authentication required — it performs a safe, non-exploitative version fingerprint via HTTP headers. Requires curl.

#!/usr/bin/env bash
# check_cve_2026_63586.sh — Weidmueller IE-SR-2TX-WL CVE-2026-63586 version check
# Usage: bash check_cve_2026_63586.sh <IP> [PORT]
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

HOST="${1:?Usage: $0 <router-ip> [port]}"
PORT="${2:-443}"
PROTOCOL="https"
[ "$PORT" = "80" ] && PROTOCOL="http"

echo "[*] Checking Weidmueller IE-SR-2TX-WL at ${HOST}:${PORT} for CVE-2026-63586"

# Attempt to grab firmware version from the web interface response headers or login page
RESPONSE=$(curl -sk --connect-timeout 10 --max-time 15 "${PROTOCOL}://${HOST}:${PORT}/" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  echo "[!] Could not connect to ${HOST}:${PORT}"
  echo "UNKNOWN"
  exit 2
fi

# Check if this looks like a Weidmueller device
if ! echo "$RESPONSE" | grep -qi -e 'weidm' -e 'IE-SR' -e 'Industrial Security Router'; then
  echo "[!] Device at ${HOST}:${PORT} does not appear to be a Weidmueller IE-SR router"
  echo "UNKNOWN"
  exit 2
fi

echo "[+] Weidmueller IE-SR device detected"

# Try to extract firmware version
VERSION=$(echo "$RESPONSE" | grep -oP '[Vv]ersion[:\s]*\K[0-9]+\.[0-9]+' | head -1 || true)

if [ -z "$VERSION" ]; then
  # Try headers
  HDR_RESPONSE=$(curl -skI --connect-timeout 10 --max-time 15 "${PROTOCOL}://${HOST}:${PORT}/" 2>/dev/null || true)
  VERSION=$(echo "$HDR_RESPONSE" | grep -oiP 'firmware[:\s/]*\K[0-9]+\.[0-9]+' | head -1 || true)
fi

if [ -z "$VERSION" ]; then
  echo "[!] Could not determine firmware version remotely"
  echo "[!] Manually check: SSH/console into device and verify firmware >= 1.57 (WL) or >= 1.74 (4G)"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected firmware version: ${VERSION}"

# Compare versions — vulnerable ranges:
# IE-SR-2TX-WL: 1.52 <= v < 1.57
# IE-SR-2TX-WL-4G-*: 1.67 <= v < 1.74
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
VER_NUM=$((MAJOR * 100 + MINOR))

# Check vulnerable ranges
if [ "$VER_NUM" -ge 152 ] && [ "$VER_NUM" -lt 157 ]; then
  echo "[!!!] VULNERABLE — IE-SR-2TX-WL firmware ${VERSION} is in vulnerable range (1.52-1.56)"
  echo "[!!!] Update to firmware >= 1.57 immediately"
  echo "VULNERABLE"
  exit 0
elif [ "$VER_NUM" -ge 167 ] && [ "$VER_NUM" -lt 174 ]; then
  echo "[!!!] VULNERABLE — IE-SR-2TX-WL-4G firmware ${VERSION} is in vulnerable range (1.67-1.73)"
  echo "[!!!] Update to firmware >= 1.74 immediately"
  echo "VULNERABLE"
  exit 0
elif [ "$VER_NUM" -ge 157 ] || [ "$VER_NUM" -ge 174 ]; then
  echo "[+] PATCHED — firmware ${VERSION} is at or above the fixed version"
  echo "PATCHED"
  exit 1
else
  echo "[?] Firmware ${VERSION} is below known vulnerable range — may be unaffected or an older model"
  echo "UNKNOWN"
  exit 2
fi

Sources

1. NVD — CVE-2026-63586 Detail
2. CERT@VDE Advisory VDE-2026-083
3. GBHackers — Weidmueller Industrial Routers Exposed to RCE Flaws
4. CyberPress — Weidmueller Industrial Router Vulnerabilities
5. Weidmueller IE-SR-2TX-WL Product & Downloads
6. Weidmueller IE-SR-2TX-WL Device Manual (PDF)
7. CISA Known Exploited Vulnerabilities Catalog