Westermo L206 F2G vulnerabilities
8 vulnerabilities
Known vulnerabilities in Westermo L206 F2G, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2023-40544westermol206-f2g_firmware+1
EPSS score0.17%
An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.CVE-2023-40143westermol206-f2g_firmware+1EPSS score0.29%
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter.CVE-2023-42765westermol206-f2g_firmware+1EPSS score0.29%
An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.CVE-2023-38579westermol206-f2g_firmware+1EPSS score0.23%
The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user to carry out an action unintentionally.CVE-2023-45213westermol206-f2g_firmware+1EPSS score0.37%
A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device.CVE-2023-45735westermol206-f2g_firmware+1EPSS score0.51%
A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.CVE-2023-45222westermol206-f2g_firmware+1EPSS score0.30%
An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter.CVE-2023-45227westermol206-f2g_firmware+1EPSS score0.29%
An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter.