CVE-2025-41663: Weidmueller Ie-Sr-2tx-Wl

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers, which are then executed with elevated privileges. To get into such a position, clients would need to use insecure proxy configurations.

Affected products

• Weidmueller Ie-Sr-2tx-Wl: before V1.49 (fixed in V1.49)
• Weidmueller Ie-Sr-2tx-Wl-4g-Eu: before V1.62 (fixed in V1.62)
• Weidmueller Ie-Sr-2tx-Wl-4g-Us-V: before V1.62 (fixed in V1.62)

Published 2025-06-11. Last modified 2026-06-17.