ads-tec Industrial IT: PHP Vulnerability in ADS-TEC IRF Products and Web Terminals

The ADS-TEC IRF1000 and IRF3000 products in firmware releases prior to 2.3.3, the IRF2000 products in firmware releases prior to 5.0.12 and the ADS-TEC web terminals DVG-SHW9019, DVG-SHW9024, DVG-MEW9016, DVG-MEW9019, DVG-MEW9024, DVG-OPW9016, DVG-OPW9019 and DVG-OPW9024 in AWT1000 software releases prior to 15.0.0 bundle a PHP version that is affected by CVE-2026-109618. In the configuration used by the products, the vulnerability allows a remote attacker to make the web interface temporarily unavailable. No authentication is required, except on IRF2000 firmware prior to 5.0.0, where the web interface is protected by HTTP digest authentication. It is fixed in IRF1000 and IRF3000 firmware 2.3.3, in IRF2000 firmware 5.0.12, which is provided under an extended support plan, and for the web terminals in AWT1000 software 15.0.0. CVE-2026-109619, which was published together with CVE-2026-109618, does not affect the products, because the PHP session extension it requires is disabled at compile time and not included in the products.

An unauthenticated remote attacker with network access to the web interface can send crafted HTTP requests that exhaust the PHP memory limit while the request is processed.

Upstream confirmed remote code execution for PHP server APIs that keep using the PHP process after the out-of-memory error, such as Apache mod_php: the request cleanup runs on the inconsistent engine state, and the same process then serves further requests. The products run exactly one PHP worker process (php-cgi, without threads). The web server passes the requests to it through a local FastCGI socket, and it handles them one after another; there is no pool of PHP processes. The known attack strategies exhaust the memory while PHP parses the HTTP request data, before the PHP script is started. In this case php-cgi does not run the request cleanup: it shuts down the PHP engine and ends the worker process. As it is the only PHP process, no PHP process with the inconsistent state remains, and the operating system releases its entire memory. A watchdog then starts a new worker with a fresh memory state, which typically takes a few seconds.

The impact is therefore limited to availability: the web interface is unavailable until the worker has been restarted, and repeated requests keep it unavailable. Confidentiality and integrity are not affected, and routing, VPN and other network functions of the device continue to operate. On IRF2000 firmware prior to 5.0.0, the web interface requires HTTP digest authentication before PHP is reached, so only authenticated users can trigger the condition.

Restrict access to the web interface to trusted networks.

Update to firmware IRF1000 v2.3.3, IRF2000 v5.0.12, IRF3000 v2.3.3 or later, and to AWT1000 software v15.0.0 or later.

ads-tec Industrial IT GmbH thanks the following parties for their efforts:

• CERTVDE for Coordination (see https://certvde.com/en/ )