Skip to content

Vendor

westermo vulnerabilities

28 published CVES affecting westermo, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
28
Critical
5
High
10
Medium
13
Low
0
Unscored
0
CISA KEV
0
Atom feed of westermo alerts

Products

Latest westermo CVEs

Newest publication first · page 1 of 2

  7. CVE-2024-36081 Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. NOTE: this is a serial-to-Ethernet converter that should not...

    Published
    CriticalCVSS 9.8 EPSS 0.57%

    Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. NOTE: this is a serial-to-Ethernet converter that should not be placed at the edge of the network.

  8. CVE-2023-40143 Westermo Lynx

    Published
    MediumCVSS 5.4 EPSS 0.29%

    An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter.

  9. CVE-2023-45735 Westermo Lynx Code Injection

    Published
    HighCVSS 8.0 EPSS 0.51%

    A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.

  10. CVE-2023-45222 Westermo Lynx Cross-site Scripting

    Published
    MediumCVSS 5.4 EPSS 0.30%

    An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter.

  12. CVE-2023-42765 Westermo Lynx Cross-site Scripting

    Published
    MediumCVSS 5.4 EPSS 0.29%

    An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.

  14. CVE-2023-45227 Westermo Lynx Cross-site Scripting

    Published
    MediumCVSS 5.4 EPSS 0.29%

    An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter.

  15. CVE-2023-38579 Westermo Lynx 206-F2G Cross-Site Request Forgery

    Published
    HighCVSS 8.8 EPSS 0.23%

    The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user to carry out an actio...

  21. CVE-2020-7227 Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web applica...

    Published
    MediumCVSS 6.5 EPSS 1.3%

    Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-di...

  25. CVE-2017-12709 A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded credentials,....

    Published
    MediumCVSS 5.3 EPSS 0.31%

    A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded credentials, which could allow for unauthorized local low-privileged access to the device.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.