What is the CVSS score of CVE-2025-46418?

CVE-2025-46418 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Westermo WeOS are affected by CVE-2025-46418?

Westermo WeOS network devices (versions 5.24+) can be completely compromised if an administrator account is breached due to an authenticated OS command injection vulnerability with no available…

How to fix or mitigate CVE-2025-46418?

Within 24 hours, inventory all Westermo WeOS 5.24+ deployments and restrict administrative access to essential personnel with multi-factor authentication enforced. Within 7 days, implement network segmentation to isolate WeOS devices from critical control systems and audit all administrative credentials for unauthorized activity or compromise indicators. Within 30 days, actively monitor Westermo security advisories for patch releases, escalate vendor communication regarding remediation timeline, and develop contingency plans including evaluation of alternative vendors if patch availability remains uncertain beyond 60 days.

Westermo WeOS CVE-2025-46418

EUVD-2025-210821 HIGH

OS Command Injection (CWE-78)

2026-09-02 mitre

GHSA-2hx8-j556-mj7h

Command Injection Weos Westermo

7.6

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.6 HIGH

AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Admin credentials required (PR:H), complex triggering conditions (AC:H), user interaction needed (UI:R), and OS-layer scope change confirmed; independent assessment aligns with provided vector.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 02, 2026 - 05:21 vuln.today

CVE Published

Sep 02, 2026 - 00:00 cve.org

HIGH 7.6

DescriptionCVE.org

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

AnalysisAI

OS command injection in Westermo WeOS 5.x (versions 5.24 and later) allows an authenticated administrator to execute arbitrary shell commands on the underlying device operating system by supplying a crafted media definition through the management interface. The scope change component of the CVSS vector confirms exploitation breaks out of the management application context into the OS layer, enabling full device compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CISA issued ICS advisory ICSA-25-261-01, elevating concern for operators in critical infrastructure sectors.

Technical ContextAI

Westermo WeOS is a proprietary embedded operating system powering Westermo's line of industrial-grade network switches and routers, commonly deployed in rail, energy, and process automation environments. The vulnerability class is CWE-78 (Improper Neutralization of Special Elements Used in an OS Command), arising when user-supplied input within a 'media definition' - a configuration construct in the device management interface - is passed to an OS shell without adequate sanitization or escaping. The CPE cpe:2.3:a:westermo:weos:*:*:*:*:*:*:*:* covers the full WeOS product line; the description bounds the affected range to the 5.x branch beginning at 5.24. The CVSS scope change (S:C) is technically significant: it reflects that the injected commands execute in the OS security context rather than being contained within the application layer, enabling persistence, pivoting, or device misconfiguration with OT-level consequences.

RemediationAI

Operators should consult CISA ICS advisory ICSA-25-261-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-01) for the vendor-confirmed patch; an exact fixed WeOS version number is not available in the provided intelligence and should not be assumed - the advisory is the authoritative source. As immediate compensating controls: restrict management interface access to a dedicated out-of-band management VLAN accessible only from trusted administrator workstations, enforcing this at the perimeter firewall level to mitigate the AV:N attack vector. Enforce strong, unique credentials and multi-factor authentication for all administrative accounts on WeOS devices; since PR:H is a hard prerequisite, reducing credential exposure directly neutralizes the attack path. Audit and minimize the number of accounts with administrator-level access on WeOS devices. Log and alert on administrative logins and configuration changes (including media definition modifications) as a detection measure. These controls do not remediate the vulnerability but substantially reduce exploitability while a patch is applied.