CVE-2026-63587

Name of the Vulnerable Software and Affected Versions IE-SR-2TX-WL-4G (affected versions not specified)

Description The SMS control function allows for password protection of SMS commands through the 'Enable Password Authorization' setting. However, the device implements a retry counter that automatically disables password authorization after 5 consecutive failed attempts. An unauthenticated remote attacker can exploit this by sending 5 or more invalid passwords via SMS, allowing subsequent commands to be executed without authentication. This can lead to limited configuration tampering, limited information leakage, and a potential full loss of availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.