Back to Database
Status published
High
CVE-2025-41684
Weidmueller: Root Command Injection via Unsanitized Input in tls_iotgen_setting Endpoint
Vulnerability Description
An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint tls_iotgen_setting).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41684
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Reid Wightman of Dragos Inc.
More from Weidmueller
View All →CVE-2025-41687
Weidmueller: Unauthenticated Stack-Based Buffer Overflow in u-link Management API
Critical
9.8
CVE-2025-41683
Weidmueller: Root Command Injection via Unsanitized Input in event_mail_test Endpoint
High
8.8
CVE-2025-41663
Weidmueller: Security routers IE-SR-2TX are affected by Command Injection
Critical
9.8
CVE-2025-41661
Weidmueller: Security routers IE-SR-2TX are affected by CSRF
High
8.8
CVE-2025-41653
Weidmueller: Denial-of-Service Vulnerability in the web server functionality of Industrial Ethernet Switches
High
7.5
Affected Vendor
Weidmueller
View all reports →Affected Software
IE-SR-2TX-WL, IE-SR-2TX-WL-4G-EU, IE-SR-2TX-WL-4G-US-V
Vulnerable Versions:
V0.0
Timeline
Official Publish:
July 23rd, 2025
Last Modified:
July 23rd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H