Back to overview

Weidmueller: Security routers IE-SR-4TX and IE-SR-4GT affected by PHP vulnerability

VDE-2026-152
Last update
11/10/2026 11:00
Published at
11/10/2026 11:00
Vendor(s)
Weidmueller Interface GmbH & Co. KG
External ID
VDE-2026-152
CSAF Document
Download

Summary

The Weidmueller security routers IE-SR-4TX and IE-SR-4GT in firmware releases prior to 2.3.4 bundle a PHP version that is affected by CVE-2026-109618. In the configuration used by the products, the vulnerability can allow an attacker to cause a denial of service by making the web interface temporarily unavailable. All other functions (Routing, Firewall etc.) are not affected. It is fixed in firmware 2.3.4. CVE-2026-109619, which was published together with CVE-2026-109618, does not affect the products.

Impact

An unauthenticated remote attacker with network access to the web interface can make it temporarily unavailable. Confidentiality and integrity are not affected; only availability of the web interface is impacted.

Affected Product(s)

Model no. Product name Affected versions
PHP vers:semver/>=8.4.0|<8.4.27, vers:semver/>=8.2.0|<8.2.35, vers:semver/>=8.5.0|<8.5.12, vers:semver/>=8.3.0|<8.3.36
2873910000 IE-SR-4GT IE-SR-4GT Firmware 1.0.0<2.3.4
2873920000 IE-SR-4GT-LTE/4G-EU IE-SR-4GT Firmware 1.0.0<2.3.4
2873930000 IE-SR-4GT-LTE/4G-USEMEA IE-SR-4GT Firmware 1.0.0<2.3.4
2990440000 IE-SR-4GT-LTE/4G-USEMEA-M IE-SR-4GT Firmware 1.0.0<2.3.4
2990450000 IE-SR-4GT-M IE-SR-4GT Firmware 1.0.0<2.3.4
2751270000 IE-SR-4TX IE-SR-4TX Firmware 1.0.0<2.3.4
2751280000 IE-SR-4TX-LTE/4G-EU IE-SR-4TX Firmware 1.0.0<2.3.4
2739630000 IE-SR-4TX-LTE/4G-USEMEA IE-SR-4TX Firmware 1.0.0<2.3.4

Vulnerabilities

Expand / Collapse all

Published
11/10/2026 09:52
Severity
5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
Improper Handling of Exceptional Conditions (CWE-755)
Summary

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

References
cve.org | nvd.nist.gov

Mitigation

Restrict access to the web interface to trusted networks.

Remediation

Update to version 2.3.4 or later.

Product Article Number Firmware File Name Affected Version Fixed Version
IE-SR-4TX 2751270000 Firmware_IE-SR-4TX_series <2.3.4 2.3.4
IE-SR-4TX-LTE/4G-EU 2751280000 Firmware_IE-SR-4TX_series <2.3.4 2.3.4
IE-SR-4TX-LTE/4G-USEMEA 2739630000 Firmware_IE-SR-4TX_series <2.3.4 2.3.4
IE-SR-4GT 2873910000 Firmware_IE-SR-4GT_series <2.3.4 2.3.4
IE-SR-4GT-LTE/4G-EU 2873920000 Firmware_IE-SR-4GT_series <2.3.4 2.3.4
IE-SR-4GT-LTE/4G-USEMEA 2873930000 Firmware_IE-SR-4GT_series <2.3.4 2.3.4
IE-SR-4GT-M 2990450000 Firmware_IE-SR-4GT_series <2.3.4 2.3.4
IE-SR-4GT-LTE/4G-USEMEA-M 2990440000 Firmware_IE-SR-4GT_series <2.3.4 2.3.4

Acknowledgments

Weidmueller Interface GmbH & Co. KG thanks the following parties for their efforts:

Revision History

Version Date Summary
1.0.0 11/10/2026 11:00 Initial version