CVE-2026-63587

Katalog CVE

CVSS 8.6 · High EPSS 0,41%

Kerentanan Authentication Bypass Using an Alternate Path or Channel. Skor CVSS 3.1 8.6 (High) menurut cert.vde.com.

Deskripsi (NVD)

The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliberately trigger this by submitting 5 or more invalid passwords, after which subsequent SMS commands are executed without requiring a password, resulting in potential limited configuration tampering, limited information leakage and potentially full loss of availability.

Rincian

Terbit di NVD

25 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Deferred

CVSS 3.1

8.6 (High), sumber cert.vde.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.certvde.com/en/advisories/VDE-2026-083/