Westermo WeOS Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2015-7547)

An attacker that successfully masquerade as an upstream DNS server may serve the WeOS device with malicious DNS query response that can allow the attacker full unauthorized access to the device. The glibc DNS client side resolver is vulnerable to a stack-based buffer overflow when the getaddrinfo...

Westermo MRD-315 ASP Source Code Disclosure (CVE-2020-7227)

Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.as...

Westermo Lynx 206-F2G Improper Control of Generation of Code (CVE-2023-45735)

A potential attacker with access to the device would be able to execute malicious code that could affect the correct functioning of the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Westermo Lynx 206-F2G Improper Neutralization of Input During Web Page Generation (CVE-2023-45227)

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'dns.0.server' parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Westermo Lynx Cross-site Scripting (CVE-2023-42765)

An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'username' parameter in the SNMP configuration. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455 Use of Hard-Coded Cryptographic Key (CVE-2016-5816)

A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded private cryptographic keys that may allow an attacker to decrypt traffic from any other source. This...

Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455 Cross-Site Request Forgery (CVE-2017-12703)

A Cross-Site Request Forgery CSRF issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible for an attacker to...

CVE-2023-45735

A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device...

CVE-2023-40143

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

CVE-2023-45213

A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device...

CVE-2023-40143

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

CVE-2023-40143 Westermo Lynx

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

CVE-2023-45735 Westermo Lynx Code Injection

A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device...

CVE-2023-45735

CVE-2023-45735 affects Westermo Lynx devices (206-F2G) running Westermo WeOS. The vulnerability is classified as Code Injection (CWE-94) with improper input handling in web interface, allowing a remote attacker with network access and low attack complexity to execute malicious code and potentiall...

CVE-2023-45735 Westermo Lynx Code Injection

A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device...

CVE-2023-45213 Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains

A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device...

CVE-2023-45213

CVE-2023-45213 affects Westermo Lynx (e.g., 206-F2G) via a Cross-Origin Resource Sharing (CORS) vulnerability in the Lynx web interface. The connected Tenable/Nessus and CISA records describe that an attacker with access to the device could execute malicious code and affect device function. The E...

CVE-2023-42765 Westermo Lynx Cross-site Scripting

An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration...

CVE-2023-42765 Westermo Lynx Cross-site Scripting

An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration...

CVE-2023-40544 Westermo Lynx Cleartext Transmission of Sensitive Information

An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications...