The IE‑SR‑2TX‑WL‑4G devices use SMS as a control interface that can be protected by a password. The firmware increments a retry counter for each failed SMS password attempt; after five consecutive failures the password protection is automatically disabled, allowing any subsequent SMS command to be executed without authentication. An unauthenticated adversary can therefore craft five wrong passwords, trigger the counter, and then send arbitrary configuration or control messages. This can lead to limited configuration changes, data exposure, and potentially loss of device availability, all with no current authentication barrier.

The vulnerability affects Weidmueller Interface products IE‑SR‑2TX‑WL‑4G‑EU and IE‑SR‑2TX‑WL‑4G‑US‑V. No specific firmware release is listed, so the issue may exist in all current releases of those models.

The flaw carries a CVSS score of 8.8, indicating high severity. EPSS data is not available, and the bug is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote attacker who can send SMS messages to the device; by intentionally sending five invalid passwords the attacker can disable the password requirement and then issue any SMS command without further authentication. The exploitation requires only the ability to transmit SMS to the device, making it a low‑entry‑barrier attack once the attacker knows the device number.