CVE-2026-63587: IE-SR-2TX-WL-4G Auth Bypass Vulnerability

CVE-2026-63587 Overview

CVE-2026-63587 affects the SMS control function of IE-SR-2TX-WL-4G industrial routers. The device supports SMS password authorization through the Enable Password Authorization setting. However, the retry counter logic automatically disables SMS password authorization after five consecutive failed authentication attempts. An unauthenticated remote attacker who can send SMS messages to the device can send five invalid passwords to disable authorization. Subsequent SMS commands execute without password verification. This vulnerability maps to [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

Critical Impact
Unauthenticated remote attackers can bypass SMS password authorization by triggering five failed attempts, enabling configuration tampering, limited information disclosure, and potential full loss of device availability.

Affected Products

IE-SR-2TX-WL-4G devices with SMS control function enabled
Devices configured with the Enable Password Authorization setting
Refer to CERT VDE Advisory VDE-2026-083 for the complete list of affected firmware

Discovery Timeline

2026-08-25 - CVE-2026-63587 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-63587

Vulnerability Analysis

The SMS control function on IE-SR-2TX-WL-4G devices enforces password authentication for SMS commands when administrators enable the Enable Password Authorization setting. The device tracks failed authentication attempts through a retry counter. After five consecutive failed SMS password attempts, the device disables SMS password authorization entirely as a lockout mechanism. This design decision inverts standard account lockout logic. Instead of blocking further attempts, the device removes the authentication requirement altogether.

An attacker with the ability to send SMS messages to the device's cellular number can weaponize this behavior. The attacker sends five SMS messages containing invalid passwords, then issues arbitrary SMS commands without authentication. The resulting access enables configuration tampering, limited information leakage, and potentially full loss of availability of the affected router.

Root Cause

The root cause is a business logic flaw in the SMS authorization state machine. The lockout mechanism was implemented to prevent the device from becoming unresponsive to legitimate SMS commands, but the fail-open behavior removes the authentication control instead of blocking attackers. This falls under [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

Attack Vector

The attack requires network reachability through the cellular SMS channel. No prior authentication or user interaction is needed. The attacker must know or discover the SIM phone number associated with the device. Once known, the attacker sends five SMS messages containing invalid password values. After the fifth failure, the retry counter triggers automatic disablement of SMS password authorization. The attacker then issues SMS commands directly, bypassing the intended authentication control.

No verified proof-of-concept code is publicly available. Technical details are documented in the CERT VDE Advisory VDE-2026-083.

Detection Methods for CVE-2026-63587

Indicators of Compromise

Sequences of five or more SMS messages containing invalid password strings sent to the device's cellular number within a short time window
Unexpected changes to device configuration parameters without corresponding administrator activity
SMS command execution logs showing successful commands immediately after a series of failed password attempts
Sudden loss of availability or unexpected reboots correlated with inbound SMS traffic

Detection Strategies

Enable and centralize SMS command logging on the device where supported, and forward logs to a SIEM for correlation
Alert on any sequence of five consecutive failed SMS password attempts followed by successful command execution
Monitor cellular carrier records for inbound SMS traffic to device SIM numbers from unknown senders
Baseline legitimate administrator SMS activity and alert on deviations in source numbers or command patterns

Monitoring Recommendations

Correlate device configuration change events with SMS command timelines to detect unauthorized modifications
Implement periodic configuration integrity checks against a known-good baseline
Track device availability metrics to identify denial-of-service conditions caused by malicious SMS commands

How to Mitigate CVE-2026-63587

Immediate Actions Required

Consult the CERT VDE Advisory VDE-2026-083 for vendor-supplied firmware updates and apply them to all affected IE-SR-2TX-WL-4G devices
Disable the SMS control function on devices where SMS-based management is not operationally required
Restrict the disclosure of device SIM phone numbers and treat them as sensitive credentials
Rotate SIM numbers on devices suspected of exposure and audit configuration state

Patch Information

Refer to CERT VDE Advisory VDE-2026-083 for firmware update availability and installation instructions. Apply firmware updates during a maintenance window and verify device configuration integrity after the update.

Workarounds

Disable the Enable Password Authorization feature and instead disable the entire SMS control function until patched firmware is installed
Configure carrier-level SMS filtering to allow inbound SMS only from a whitelist of authorized administrator numbers, where supported
Use alternative authenticated management channels such as VPN-tunneled HTTPS or SSH instead of SMS control

bash

# Configuration example - disable SMS control function via device web UI
# Navigate to: System > SMS Control
# Set: SMS Control Function = Disabled
# Or where CLI is available:
# config system sms-control
#   set enable disable
# end