Skip to content
OpenAdvisories
High ICSA-24-023-04 8 CVEs

Westermo Lynx 206-F2G

Published Jan 23, 2024 · Updated Jan 23, 2024

Vendor: Westermo Product: Lynx Firmware Product: Lynx Model

Summary

Successful exploitation of these vulnerabilities could allow an attacker to access the web application, inject arbitrary code, execute malicious code, obtain sensitive information, or execute a malicious request.

Vulnerabilities 8

  • High 8.0
    CVE-2023-38579

    Westermo Lynx 206-F2G Cross-Site Request Forgery

    The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user …

    Westermo Lynx
  • High 8.0
    CVE-2023-45735

    Westermo Lynx Code Injection

    A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.

    Westermo Lynx
  • Medium 6.6
    CVE-2023-45213

    Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains

    A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device.

    Westermo Lynx
  • Medium 5.7
    CVE-2023-40544

    Westermo Lynx Cleartext Transmission of Sensitive Information

    An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.

    Westermo Lynx
  • Medium 5.4
    CVE-2023-40143

    Westermo Lynx

    An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter.

    Westermo Lynx
  • Medium 5.4
    CVE-2023-42765

    Westermo Lynx Cross-site Scripting

    An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.

    Westermo Lynx
  • Medium 5.4
    CVE-2023-45222

    Westermo Lynx Cross-site Scripting

    An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter.

    Westermo Lynx
  • Medium 5.4
    CVE-2023-45227

    Westermo Lynx Cross-site Scripting

    An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter.

    Westermo Lynx

Revision history

  1. #1

    Initial Publication

References