Westermo vulnerabilities
24 vulnerabilities
Known vulnerabilities in Westermo products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.
Products
14- L206 F2G8 vulnerabilities
- Lynx8 vulnerabilities
- Pmi 110 F2G5 vulnerabilities
- Weos4 vulnerabilities
- L210 F2G Lynx3 vulnerabilities
- Mrd 305 Din3 vulnerabilities
- Mrd 315 Din3 vulnerabilities
- Mrd 355 Din3 vulnerabilities
- Mrd 455 Din3 vulnerabilities
- L210 F2G2 vulnerabilities
- Mrd 3151 vulnerabilities
- Dr 2500 vulnerabilities
- Dr 2600 vulnerabilities
- Mr 2600 vulnerabilities
CVE-2015-7923westermoweos
EPSS score1.21%
Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.CVE-2016-5816westermomrd-305-din_firmware+3EPSS score1.53%
A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded private cryptographic keys that may allow an attacker to decrypt traffic from any other source.CVE-2025-54319westermoweosEPSS score0.35%
An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system logging information (syslog verbose logging that includes credentials).CVE-2025-46419westermoweosEPSS score0.37%
Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.CVE-2025-46418westermoweosEPSS score0.68%
Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.CVE-2020-7227westermomrd-315_firmwareEPSS score1.31%
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, backup.asp, sys-power.asp, ifaces-wls.asp, ifaces-wls-pkt.asp, and ifaces-wls-pkt-adv.asp.CVE-2020-12501korenixjetnet+15EPSS score3.34%
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.CVE-2020-12502korenixjetnet+12EPSS score1.03%
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.CVE-2020-12500korenixjetnet+2EPSS score2.89%
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administration.CVE-2020-12504korenixjetnet+19EPSS score3.02%
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.CVE-2020-12503korenixjetnet+17EPSS score22.83%
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections.CVE-2017-12709westermomrd-305-din_firmware+3EPSS score0.31%
A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded credentials, which could allow for unauthorized local low-privileged access to the device.CVE-2017-12703westermomrd-305-din_firmware+3EPSS score0.64%
A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible for an attacker to trick a user into making a malicious request to the server.CVE-2024-37183westermol210-f2g_firmware+1EPSS score0.25%
Plain text credentials and session ID can be captured with a network sniffer.CVE-2024-32943westermol210-f2g_firmware+1EPSS score0.48%
An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly.CVE-2024-35246westermol210-f2g_lynx_firmwareEPSS score0.48%
An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.CVE-2023-40544westermol206-f2g_firmware+1EPSS score0.17%
An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.CVE-2023-40143westermol206-f2g_firmware+1EPSS score0.29%
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter.CVE-2023-42765westermol206-f2g_firmware+1EPSS score0.29%
An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.CVE-2023-38579westermol206-f2g_firmware+1EPSS score0.23%
The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user to carry out an action unintentionally.