A Web‑based management interface on certain Weidmueller devices runs a modified uhttpd server that executes CGI shell scripts. The HTTP Basic Authentication username is taken directly from the Authorization header and concatenated into a shell command that is invoked via system(). Because the username value is not sanitized, an attacker can embed shell metacharacters into the username and break out of the intended command context. The result is that an unauthenticated network attacker can execute arbitrary shell commands as root with no credential or further interaction, giving full control of the device. The weakness is a classic shell injection (CWE‑78).

Weidmueller Interface: IE‑SR‑2TX‑WL, IE‑SR‑2TX‑WL‑4G‑EU, and IE‑SR‑2TX‑WL‑4G‑US‑V are affected. No specific firmware revision is listed, so any firmware that includes the vulnerable uhttpd CGI scripts should be considered at risk.

The CVSS score of 9.3 indicates a critical level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs network reach to the device’s HTTP port and does not require valid credentials: a crafted HTTP request with a malicious username can be delivered directly. As the exploitation requires no authentication and can be performed from any IP address that can reach the web interface, the likelihood of exploitation in exposed environments is high.