Westermo records

21 published records for vendor westermo.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

21 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2020-12504No exploit	Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx productspepperl-fuchs · es7510-xt firmware · CWE-912 Pre-auth	Critical9.8	—	3.0%	Oct 15, 2020
39Monitor	CVE-2024-36081No exploit	Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password.CWE-256 Pre-auth	Critical9.8	—	0.5%	May 19, 2024
36Monitor	CVE-2018-19612No exploit	The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types anwestermo · dr-250 firmware · CWE-434 File upload	High8.8	—	1.9%	May 24, 2019
36Monitor	CVE-2015-7923No exploit	Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-miwestermo · weos · CWE-310 Pre-auth	Critical9.0	—	1.2%	Jan 30, 2016
35Monitor	CVE-2017-12703No exploit	A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 westermo · mrd-305-din firmware · CWE-352 Pre-auth CSRF	High8.8	—	0.6%	Aug 25, 2017
35Monitor	CVE-2023-38579No exploit	Westermo Lynx 206-F2G Cross-Site Request Forgerywestermo · l206-f2g firmware · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Feb 6, 2024
34Monitor	CVE-2024-35246No exploit	Westermo L210-F2G Lynx Improper Control of Interaction Frequencywestermo · l210-f2g lynx firmware · CWE-799 Pre-auth	High8.7	—	0.4%	Jun 20, 2024
34Monitor	CVE-2024-32943No exploit	Westermo L210-F2G Lynx Improper Control of Interaction Frequencywestermo · l210-f2g firmware · CWE-799 Pre-auth	High8.7	—	0.4%	Jun 20, 2024
32Monitor	CVE-2023-45735No exploit	Westermo Lynx Code Injectionwestermo · l206-f2g firmware · CWE-94 RCE	High8.0	—	0.5%	Feb 6, 2024
30Monitor	CVE-2016-5816No exploit	A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versionwestermo · mrd-305-din firmware · CWE-798 Pre-auth Hard-coded credentials	High7.5	—	1.5%	Aug 25, 2017
27Monitor	CVE-2024-37183No exploit	Westermo L210-F2G Lynx Cleartext Transmission of Sensitive Informationwestermo · l210-f2g firmware · CWE-319 Pre-auth Weak crypto	Medium6.9	—	0.2%	Jun 20, 2024
26Monitor	CVE-2020-7227No exploit	Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retriewestermo · mrd-315 firmware	Medium6.5	—	1.3%	Jan 18, 2020
26Monitor	CVE-2018-19613No exploit	Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allow CSRF.westermo · dr-260 firmware · CWE-352 Pre-auth CSRF	Medium6.5	—	0.5%	May 24, 2019
26Monitor	CVE-2023-45213No exploit	Westermo Lynx Permissive Cross-domain Policy with Untrusted Domainswestermo · l206-f2g firmware · CWE-942	Medium6.5	—	0.3%	Feb 6, 2024
24Monitor	CVE-2018-19614No exploit	XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers.westermo · dr-250 firmware · CWE-79 Pre-auth XSS	Medium6.1	—	0.8%	May 23, 2019
22Monitor	CVE-2023-40544No exploit	Westermo Lynx Cleartext Transmission of Sensitive Informationwestermo · l206-f2g firmware · CWE-319 Pre-auth Weak crypto	Medium5.7	—	0.1%	Feb 6, 2024
21Monitor	CVE-2017-12709No exploit	A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions oldewestermo · mrd-305-din firmware · CWE-798 Local privilege escalation Hard-coded credentials	Medium5.3	—	0.3%	Aug 25, 2017
21Monitor	CVE-2023-45222No exploit	Westermo Lynx Cross-site Scriptingwestermo · l206-f2g firmware · CWE-79 XSS	Medium5.4	—	0.2%	Feb 6, 2024
21Monitor	CVE-2023-40143No exploit	An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecwestermo · l206-f2g firmware · CWE-79 XSS	Medium5.4	—	0.2%	Feb 6, 2024
21Monitor	CVE-2023-45227No exploit	Westermo Lynx Cross-site Scriptingwestermo · l206-f2g firmware · CWE-79 XSS	Medium5.4	—	0.2%	Feb 6, 2024
21Monitor	CVE-2023-42765No exploit	Westermo Lynx Cross-site Scriptingwestermo · l206-f2g firmware · CWE-79 XSS	Medium5.4	—	0.2%	Feb 6, 2024

CVE-2020-12504
40Plan
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
CriticalCVSS 9.8No exploitEPSS 3%
- Pre-auth
pepperl-fuchs · es7510-xt firmwareOct 15, 2020
CVE-2024-36081
39Monitor
Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
May 19, 2024
CVE-2018-19612
36Monitor
The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types an
HighCVSS 8.8No exploitEPSS 1%
- File upload
westermo · dr-250 firmwareMay 24, 2019
CVE-2015-7923
36Monitor
Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-mi
CriticalCVSS 9.0No exploitEPSS 1%
- Pre-auth
westermo · weosJan 30, 2016
CVE-2017-12703
35Monitor
A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
westermo · mrd-305-din firmwareAug 25, 2017
CVE-2023-38579
35Monitor
Westermo Lynx 206-F2G Cross-Site Request Forgery
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
westermo · l206-f2g firmwareFeb 6, 2024
CVE-2024-35246
34Monitor
Westermo L210-F2G Lynx Improper Control of Interaction Frequency
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
westermo · l210-f2g lynx firmwareJun 20, 2024
CVE-2024-32943
34Monitor
Westermo L210-F2G Lynx Improper Control of Interaction Frequency
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
westermo · l210-f2g firmwareJun 20, 2024
CVE-2023-45735
32Monitor
Westermo Lynx Code Injection
HighCVSS 8.0No exploitEPSS 0%
- RCE
westermo · l206-f2g firmwareFeb 6, 2024
CVE-2016-5816
30Monitor
A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 version
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Hard-coded credentials
westermo · mrd-305-din firmwareAug 25, 2017
CVE-2024-37183
27Monitor
Westermo L210-F2G Lynx Cleartext Transmission of Sensitive Information
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Weak crypto
westermo · l210-f2g firmwareJun 20, 2024
CVE-2020-7227
26Monitor
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrie
MediumCVSS 6.5No exploitEPSS 1%
westermo · mrd-315 firmwareJan 18, 2020
CVE-2018-19613
26Monitor
Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allow CSRF.
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- CSRF
westermo · dr-260 firmwareMay 24, 2019
CVE-2023-45213
26Monitor
Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains
MediumCVSS 6.5No exploitEPSS 0%
westermo · l206-f2g firmwareFeb 6, 2024
CVE-2018-19614
24Monitor
XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
westermo · dr-250 firmwareMay 23, 2019
CVE-2023-40544
22Monitor
Westermo Lynx Cleartext Transmission of Sensitive Information
MediumCVSS 5.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
westermo · l206-f2g firmwareFeb 6, 2024
CVE-2017-12709
21Monitor
A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions olde
MediumCVSS 5.3No exploitEPSS 0%
- Local privilege escalation
- Hard-coded credentials
westermo · mrd-305-din firmwareAug 25, 2017
CVE-2023-45222
21Monitor
Westermo Lynx Cross-site Scripting
MediumCVSS 5.4No exploitEPSS 0%
- XSS
westermo · l206-f2g firmwareFeb 6, 2024
CVE-2023-40143
21Monitor
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injec
MediumCVSS 5.4No exploitEPSS 0%
- XSS
westermo · l206-f2g firmwareFeb 6, 2024
CVE-2023-45227
21Monitor
Westermo Lynx Cross-site Scripting
MediumCVSS 5.4No exploitEPSS 0%
- XSS
westermo · l206-f2g firmwareFeb 6, 2024
CVE-2023-42765
21Monitor
Westermo Lynx Cross-site Scripting
MediumCVSS 5.4No exploitEPSS 0%
- XSS
westermo · l206-f2g firmwareFeb 6, 2024