Vendor
Westermo
19 known vulnerabilities.
Westermo at a glance
- Last 12 months
- 1
- Critical · all time
- 3
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 1 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 1 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Critical
Westermo Industrial Switch Hard-coded Certificate Vulnerability (Update A)
first Oct 31, 2016 -
High max 7.5ICSA-24-172-03 3 CVEs
Westermo L210-F2G
Successful exploitation of these vulnerabilities could crash the device being accessed or may allow remote code execution.
-
Critical max 9.8ICSA-24-151-04 2 CVEs
Westermo EDW-100
Successful exploitation of these vulnerabilities could allow an attacker to access the device using hardcoded credentials and download cleartext username and passwords.
-
High max 8.0ICSA-24-023-04 8 CVEs
Westermo Lynx 206-F2G
Successful exploitation of these vulnerabilities could allow an attacker to access the web application, inject arbitrary code, execute malicious code, obtain sensitive information, or execute a malicious request.
-
CriticalICSA-17-236-01 3 CVEs
ICSA-17-236-01_Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455
Mandar Jadhav from Qualys Security has identified the vulnerabilities.
19 results · Feed
-
High 7.6
Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.
-
Medium 6.3
An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized acce…
-
Medium 5.9
Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.
-
High 7.5
Westermo L210-F2G Lynx Improper Control of Interaction Frequency
An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly.
-
High 7.5
Westermo L210-F2G Lynx Improper Control of Interaction Frequency
An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.
-
Medium 5.7
Westermo L210-F2G Lynx Cleartext Transmission of Sensitive Information
Plain text credentials and session ID can be captured with a network sniffer.
-
Medium 5.4
Westermo Lynx
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter.
-
High 8.0
Westermo Lynx Code Injection
A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.
-
Medium 5.4
Westermo Lynx Cross-site Scripting
An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter.
-
Medium 6.6
Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains
A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device.
-
Medium 5.4
Westermo Lynx Cross-site Scripting
An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.
-
Medium 5.7
Westermo Lynx Cleartext Transmission of Sensitive Information
An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.
-
Medium 5.4
Westermo Lynx Cross-site Scripting
An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter.
-
High 8.0
Westermo Lynx 206-F2G Cross-Site Request Forgery
The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user …
-
Critical 9.8
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…
-
High 7.2CVE-2020-12503 EPSS 23%
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…
-
High 8.8
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…
-
Critical 9.8
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.
-
Critical 9.8
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administratio…