CVE-2025-41663: For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH…

PriorityP261critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.55%

41.8th percentile

For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers, which are then executed with elevated privileges. To get into such a position, clients would need to use insecure proxy configurations.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
weidmueller	ie-sr-2tx-wl	< V1.49	V1.49
weidmueller	ie-sr-2tx-wl-4g-eu	< V1.62	V1.62
weidmueller	ie-sr-2tx-wl-4g-us-v	< V1.62	V1.62

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.