151 matches found
Westermo EDW-100 安全漏洞
The Westermo EDW-100 is a serial Ethernet converter from Westermo Sweden. A security vulnerability exists in the Westermo EDW-100 version 2024-05-03 and earlier, which originates from allowing an unauthenticated user to download a configuration file containing a password in clear text...
Westermo EDW-100 安全漏洞
The Westermo EDW-100 is a serial Ethernet converter from Westermo Sweden. A security vulnerability exists in the Westermo EDW-100 version 2024-05-03 and earlier, which stems from the presence of a hard-coded password...
PT-2024-4479 · Westermo · Westermo Edw-100
Name of the Vulnerable Software and Affected Versions: Westermo EDW-100 devices through 2024-05-03 Description: The issue is related to the storage of a password in cleartext in a configuration file. An unauthenticated user can download this configuration file, potentially revealing the username...
Westermo Lynx 206-F2G Improper Control of Generation of Code (CVE-2023-45735)
A potential attacker with access to the device would be able to execute malicious code that could affect the correct functioning of the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...
Westermo Lynx Cross-site Scripting (CVE-2023-42765)
An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'username' parameter in the SNMP configuration. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Westermo DR-250, DR-260 and MR-260 Cross-site Scripting (CVE-2018-19614)
XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...
Westermo MRD-315 ASP Source Code Disclosure (CVE-2020-7227)
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.as...
Westermo WeOS Stack-Based Buffer Overflow (CVE-2015-7547)
An attacker that successfully masquerade as an upstream DNS server may serve the WeOS device with malicious DNS query response that can allow the attacker full unauthorized access to the device. The glibc DNS client side resolver is vulnerable to a stack-based buffer overflow when the getaddrinfo...
Westermo Lynx 206-F2G Cleartext Transmission of Sensitive Information (CVE-2023-40544)
An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Westermo WeOS Cryptographic Issues (CVE-2015-7923)
Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in- the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key. This plugin only works with Tenable.ot. Please visit...
Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455 Cross-Site Request Forgery (CVE-2017-12703)
A Cross-Site Request Forgery CSRF issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible for an attacker to...
Westermo xRD Products Authentication Bypass (CVE-2018-10933)
libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2MSGUSERAUTHSUCCESS message in place of the SSH2MSGUSERAUTHREQUEST message which the server would expect to initiate authentication, the attacker could successfully...
Westermo Lynx 206-F2G Permissive Cross-Domain Security Policy with Untrusted Domains (CVE-2023-45213)
A potential attacker with access to the device would be able to execute malicious code that could affect the correct functioning of the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...
Westermo DR-250, DR-260 and MR-260 Cross-Site Request Forgery (CVE-2018-19613)
Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allow CSRF. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid502178; scriptversion"1.1";...
Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455 Use of Hard-Coded Credentials (CVE-2017-12709)
A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded credentials, which could allow for unauthorized local low-privileged access to the device. This plugin only...
Westermo Lynx 206-F2G Improper Neutralization of Input During Web Page Generation (CVE-2023-45227)
An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'dns.0.server' parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Westermo Lynx 206-F2G Cross-Site Request Forgery (CVE-2023-38579)
The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user to carry out an action unintentionally...
Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455 Use of Hard-Coded Cryptographic Key (CVE-2016-5816)
A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded private cryptographic keys that may allow an attacker to decrypt traffic from any other source. This...
Westermo Lynx 206-F2G Improper Neutralization of Input During Web Page Generation (CVE-2023-40143)
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'forward.0.domain' parameter. This plugin only works with Tenable.ot. Please visit...
Westermo DR-250, DR-260 and MR-260 Unrestricted Upload of File with Dangerous Type (CVE-2018-19612)
The '/uploadfile' functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 809...