Westermo
22 CVEs across 27 Westermo products. Browse Westermo vulnerabilities, severities, and proof-of-concept exploits.
Westermo products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54319 | Medium | 6.3 | 2025-07-20 | An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system l… |
CVE-2025-46419 | Medium | 5.9 | 2025-04-24 | Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet. |
CVE-2024-35246 | High | 7.5 | 2024-06-20 | An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly. |
CVE-2024-32943 | High | 7.5 | 2024-06-20 | An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly. |
CVE-2024-37183 | Medium | 5.7 | 2024-06-20 | Plain text credentials and session ID can be captured with a network sniffer. |
CVE-2023-45735 | High | 8.0 | 2024-02-06 | A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device… |
CVE-2023-45227 | Medium | 5.4 | 2024-02-06 | An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting… |
CVE-2023-45222 | Medium | 5.4 | 2024-02-06 | An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting pay… |
CVE-2023-45213 | Medium | 6.6 | 2024-02-06 | A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the de… |
CVE-2023-42765 | Medium | 5.4 | 2024-02-06 | An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username… |
CVE-2023-40544 | Medium | 5.7 | 2024-02-06 | An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive informat… |
CVE-2023-40143 | Medium | 5.4 | 2024-02-06 | An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site s… |
CVE-2023-38579 | High | 8.0 | 2024-02-06 | The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which… |
CVE-2020-12504 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12503 | High | 7.2 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12502 | High | 8.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12501 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12500 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-7227 | Medium | 6.5 | 2020-01-18 | Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code… |
CVE-2018-19613 | Medium | 6.5 | 2019-05-24 | Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allow CSRF. |
CVE-2018-19612 | High | 8.8 | 2019-05-24 | The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code. |
CVE-2018-19614 | Medium | 6.1 | 2019-05-23 | XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers. |
CVE-2017-12709 | Medium | 5.3 | 2017-08-25 | A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The… |
CVE-2017-12703 | High | 8.8 | 2017-08-25 | A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than… |
CVE-2016-5816 | High | 7.5 | 2017-08-25 | A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5… |
CVE-2015-7923 | Critical | 9.0 | 2016-01-30 | Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to d… |