CVE-2026-63587 in IE-SR-2TX-WL-4G
Summary
by MITRE • 08/25/2026
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliberately trigger this by submitting 5 or more invalid passwords, after which subsequent SMS commands are executed without requiring a password, resulting in potential limited configuration tampering, limited information leakage and potentially full loss of availability.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in the IE-SR-2TX-WL-4G device represents a critical flaw within its Short Message Service control interface, specifically stemming from an insecure implementation of authentication persistence mechanisms. The device is designed to protect SMS-based administrative commands through an Enable Password Authorization feature, which mandates that users provide valid credentials before executing configuration changes or retrieving sensitive information via text message. This mechanism is intended to prevent unauthorized remote access over cellular networks, a vector often exploited due to the perceived trust in mobile communication protocols and the physical remoteness of many industrial deployments. However, the underlying logic governing this authentication state contains a significant design error that allows an attacker to bypass security controls entirely through a denial-of-service style attack on the authentication subsystem itself.
The technical root cause lies in how the device handles failed authentication attempts. Upon receiving an SMS command with incorrect credentials, the system increments a retry counter and temporarily rejects the request. The critical flaw occurs when this counter reaches five consecutive failures; instead of locking out the user or requiring additional verification steps such as a reset procedure or time-based cooldown, the firmware automatically disables the password authorization requirement entirely for subsequent sessions. This behavior effectively transforms an authentication bypass attempt into a successful privilege escalation event without any knowledge of the actual administrative password. An unauthenticated remote attacker who possesses the ability to send SMS messages to the device can exploit this by systematically submitting five invalid passwords in succession. Once this threshold is crossed, the security gate remains open indefinitely until manually reset or rebooted, allowing all future SMS commands to be executed with full privileges.
The operational impact of this vulnerability is severe and multifaceted, affecting confidentiality, integrity, and availability within the industrial environment where these devices are typically deployed. With password authorization disabled, an attacker gains unrestricted access to the device's configuration interface via SMS. This leads to potential limited information leakage as sensitive network parameters, IP addresses, and connected device details can be exfiltrated through simple text commands. Furthermore, it enables limited configuration tampering, allowing adversaries to alter routing tables, disable security features, or reconfigure cellular settings to disrupt normal operations. Most critically, the vulnerability poses a risk of full loss of availability; an attacker could issue commands that reset the device, disconnect it from the network, or flood associated systems with malicious traffic, effectively taking down critical infrastructure components such as remote monitoring stations or industrial control points without physical access.
From a classification perspective, this flaw aligns closely with CWE-287, which describes Improper Authentication, specifically regarding the failure to maintain authentication state correctly after repeated failures. It also relates to CWE-613, Insufficient Session Expiration, as the session security is permanently degraded rather than temporarily suspended or revoked securely. In terms of offensive tactics, this exploitation technique maps directly to MITRE ATT&CK T1078, Valid Accounts, where an attacker leverages valid credentials or, in this case, a bypassed authentication mechanism to gain access. Additionally, the method of triggering the condition through repeated failed attempts is characteristic of brute-force attacks, though here it serves as a denial-of-service vector against the security control rather than a password cracking attempt.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately verify if any devices are running vulnerable firmware versions and apply vendor-provided patches that correct the retry counter logic to either lock out after failures or require explicit re-authentication upon reset. In environments where patching is not immediately feasible, network segmentation strategies should be employed to restrict SMS traffic from untrusted networks, ensuring that only authorized cellular gateways can communicate with these devices. Additionally, implementing strict rate-limiting on the SMS interface at a firewall level can prevent rapid successive attempts that trigger this vulnerability. Long-term solutions involve redesigning the authentication module to enforce exponential backoff delays or account lockouts after multiple failures, thereby neutralizing both brute-force and denial-of-service attacks against the authentication subsystem while maintaining operational continuity for legitimate users.