Westermo WeOS EUVD-2025-210821

Exploitation requires valid administrator-level credentials on the target WeOS device (PR:H per CVSS). High attack complexity (AC:H) applies - the precise nature of these conditions is not detailed in the available description but likely involves specific configuration state or procedural steps during media definition processing. User interaction (UI:R) is required, indicating that an administrator must actively trigger processing of the crafted media definition rather than it being exploited passively. The affected version range is explicitly WeOS 5.x starting at 5.24; versions prior to 5.24 and WeOS 4.x are not confirmed affected. Network access to the management interface is required (AV:N), though industrial deployments typically expose management interfaces on isolated OT networks rather than the internet. Key limiting factors: pre-existing admin credential compromise is a hard prerequisite; AC:H imposes additional barriers to reliable exploitation; UI:R means passive drive-by exploitation is not possible.

The CVSS 7.6 High score is driven primarily by the full C:H/I:H/A:H impact with scope change, but the actual exploitation preconditions are heavily constraining: AV:N/AC:H/PR:H/UI:R means an attacker needs valid administrator credentials, must satisfy high-complexity conditions, and requires user interaction - a compound set of prerequisites that substantially reduces opportunistic exploitation risk. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS data was not available in the provided intelligence, leaving exploitation probability unquantified. The CISA ICS advisory designation (ICSA-25-261-01) signals this is a credible finding in OT/ICS contexts where even a mid-sized industrial network operator in a deployment like sopot should treat it seriously given the potential for admin credential theft via spear-phishing or insider threat. The realistic threat profile is a targeted attacker with prior admin access using this vulnerability to escalate lateral movement or persist within an industrial network, not an opportunistic internet-facing exploit. Overall, this is a genuine but operationally constrained High - real priority for environments with weak admin-account hygiene, lower priority for those with MFA-enforced management access.

An attacker who has obtained valid WeOS administrator credentials - via spear-phishing of an OT network engineer or lateral movement from a compromised IT management workstation - logs into the device management interface and crafts a media definition containing shell metacharacters that inject an OS command payload. Under the specific conditions required by the high attack complexity rating, the administrator (or the attacker posing as one) triggers processing of the definition, causing the device to execute the injected command as the underlying OS user, potentially installing a persistent backdoor or reconfiguring the industrial switch to enable further network access.