彙總 westermo 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 跨站腳本與CSRF 等問題，部分漏洞可能導致 工作階段劫持，並影響 生產負載與軟體部署 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2024-35246 | An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly. | [email protected] | 8.7 | 0.48% | 2024-06-20 | 2026-06-17 |
| CVE-2024-32943 | An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly. | [email protected] | 8.7 | 0.48% | 2024-06-20 | 2026-06-17 |
| CVE-2024-37183 | Plain text credentials and session ID can be captured with a network sniffer. | [email protected] | 6.9 | 0.25% | 2024-06-20 | 2026-06-17 |
| CVE-2023-45735 | A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device. | [email protected] | 8.0 | 0.51% | 2024-02-06 | 2026-06-17 |
| CVE-2023-45227 | An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter. | [email protected] | 5.4 | 0.29% | 2024-02-06 | 2026-06-17 |
| CVE-2023-45222 | An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter. | [email protected] | 5.4 | 0.29% | 2024-02-06 | 2026-06-17 |
| CVE-2023-45213 | A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device. | [email protected] | 6.6 | 0.37% | 2024-02-06 | 2026-06-17 |
| CVE-2023-42765 | An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration. | [email protected] | 5.4 | 0.29% | 2024-02-06 | 2026-06-17 |
| CVE-2023-40544 | An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications. | [email protected] | 5.7 | 0.17% | 2024-02-06 | 2026-06-17 |
| CVE-2023-40143 | An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter. | [email protected] | 5.4 | 0.29% | 2024-02-06 | 2026-06-17 |
| CVE-2023-38579 | The cross-site request forgery token in the request may be predictable or easily guessable allowing attackers to craft a malicious request, which could be triggered by a victim unknowingly. In a successful CSRF attack, the attacker could lead the victim user to carry out an action unintentionally. | [email protected] | 8.0 | 0.23% | 2024-02-06 | 2026-06-17 |
| CVE-2020-12504 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service. | [email protected] | 9.8 | 2.98% | 2020-10-15 | 2026-06-16 |
| CVE-2020-7227 | Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, backup.asp, sys-power.asp, ifaces-wls.asp, ifaces-wls-pkt.asp, and ifaces-wls-pkt-adv.asp. | [email protected] | 6.5 | 1.31% | 2020-01-18 | 2026-06-16 |
| CVE-2018-19613 | Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allow CSRF. | [email protected] | 6.5 | 0.56% | 2019-05-24 | 2026-06-16 |
| CVE-2018-19612 | The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code. | [email protected] | 8.8 | 1.96% | 2019-05-24 | 2026-06-16 |
| CVE-2018-19614 | XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers. | [email protected] | 6.1 | 0.86% | 2019-05-23 | 2026-06-16 |
| CVE-2017-12709 | A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded credentials, which could allow for unauthorized local low-privileged access to the device. | [email protected] | 5.3 | 0.31% | 2017-08-25 | 2026-06-16 |
| CVE-2017-12703 | A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible for an attacker to trick a user into making a malicious request to the server. | [email protected] | 8.8 | 0.64% | 2017-08-25 | 2026-06-16 |
| CVE-2016-5816 | A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded private cryptographic keys that may allow an attacker to decrypt traffic from any other source. | [email protected] | 7.5 | 1.53% | 2017-08-25 | 2026-06-16 |
| CVE-2015-7923 | Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key. | [email protected] | 9.0 | 1.21% | 2016-01-30 | 2026-06-16 |