An authenticated remote command injection vulnerability in Weidmueller industrial devices allows attackers to gain root-level access and compromise the entire system.

This is an OS Command Injection (CWE-78) vulnerability occurring within the Main Web Interface at the event_mail_test endpoint. An authenticated attacker can leverage this flaw to execute arbitrary system commands with root privileges.

Successful exploitation of this vulnerability grants an attacker full control over the affected industrial device. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to unauthorized data access, complete system compromise, and potential disruption of critical industrial processes.

Immediate Action: Apply the vendor-provided security updates identified in the VDE-2025-052 advisory as soon as they become available. Ensure all devices are upgraded to at least version V1.49 or V1.62 respectively.

Proactive Monitoring: Monitor system logs for unusual activity, specifically looking for unexpected command execution patterns or unauthorized attempts to access the event_mail_test endpoint.

Compensating Controls: Restrict access to the device management interface to trusted administrative networks only and implement strict firewall rules to prevent unauthorized users from reaching the web interface.

Public Exploit Available: Unknown

Due to the potential for full system compromise, IT and OT security teams must prioritize this vulnerability. Once the vendor releases the necessary firmware updates, they should be tested and deployed immediately to eliminate the root command injection vector.