Western Telematic Inc NPS Series, DSM Series, CPM Series

Summary

Vulnerabilities 1

• Medium 6.5
  CVE-2025-0630

  Western Telematic Inc NPS Series, DSM Series, CPM Series External Control of File Name or Path

  Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any authenticated user has privileged access to files on the device's filesystem.

  Western Telematic Console Server (DSM Series) Network Power Switch (NPS Series) Console Server + PDU Combo Unit (CPM Series)
  Feb 4, 2025

Revision history

1. 2025-02-04 #1

   Initial Publication

References

• ICSA Advisory ICSA-25-035-01 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-01
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014