Authentication Bypass Vulnerability in IE-SR-2TX-WL-4G Devices by VDE

CVE-2026-63587

What is CVE-2026-63587?

The SMS control feature of IE-SR-2TX-WL-4G devices can be exploited due to improper password authorization settings. When the 'Enable Password Authorization' feature is active, the device counts failed password attempts, disabling SMS password protection after five failed tries. An attacker can exploit this by sending multiple incorrect SMS commands, which leads to unauthorized SMS command execution without the need for a password. This vulnerability may allow attackers to tamper with configurations, access limited data, or disrupt the device's availability.

References