Weos
Monthly
OS command injection in Westermo WeOS 5.x (versions 5.24 and later) allows an authenticated administrator to execute arbitrary shell commands on the underlying device operating system by supplying a crafted media definition through the management interface. The scope change component of the CVSS vector confirms exploitation breaks out of the management application context into the OS layer, enabling full device compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CISA issued ICS advisory ICSA-25-261-01, elevating concern for operators in critical infrastructure sectors.
Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
OS command injection in Westermo WeOS 5.x (versions 5.24 and later) allows an authenticated administrator to execute arbitrary shell commands on the underlying device operating system by supplying a crafted media definition through the management interface. The scope change component of the CVSS vector confirms exploitation breaks out of the management application context into the OS layer, enabling full device compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CISA issued ICS advisory ICSA-25-261-01, elevating concern for operators in critical infrastructure sectors.
Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.