Security advisories

Security advisories are published for moderate and high-risk security issues related to Westermo products. To receive Westermo security advisory emails directly to your inbox, complete the form below.

If you were to experience any product security issues, we encourage you to contact our PSIRT team.

2024

• westermo sa unauthorized exposure of information through directory listing (Westermo 24-03) 2024-04-08
• westermo_sa_vulnerabilities_in_web_interface_for_weos_products (Westermo 24-01) 2024-02-23
• westermo_sa_vulnerabilities_in_web_interface_for_weos_products (Westermo 24-02) 2024-02-23

2023

• Security Vulnerability regarding SNMPv3 in Ibex SW (Westermo 23-01) 2023-01-11

2022

No security advisories issued.

2021

• Eltec response to Log4j2 vulnerability related to OpenWRT (Eltec 21-01) 2021-12-20
• Westermo response to Log4j2 vulnerability related to xRD FW (Westermo 21-05) 2021-12-20
• Westermo response to Log4j2 vulnerability related to Ibex SW (Westermo 21-04) 2021-12-17
• Westermo response to Log4j2 vulnerability related to WeOS (Westermo 21-03) 2021-12-14
• Security Vulnerability in the wireless 802.11 implementation (Westermo 21-02) 2021-07-19
• Security Vulnerability in SSH (Westermo 21-01) 2021-02-09

2020

• Westermo Response to Ripple20 (Westermo 20-02) 2020-07-31
• Security Vulnerability in the PPP Package (Westermo-20-01) 2020-03-31
  

2019

No security advisories issued.

2018

• LibSSH - Authentication Bypass Vulnerability (Westermo-18-05) 2018-11-26
• Vulnerabilities in BusyBox (Westermo-18-04) 2018-05-29
• Mongoose web server vulnerabilities (Westermo-18-03) 2018-05-29
• WeOS Vulnerable to Cross Site Request Forgery attack (Westermo-18-02) 2018-05-29
• Meltdown and Spectre (Westermo-18-01) 2018-01-05

2017

• WiFi key reinstallation attack (WEOS-17-03) 2017-10-17
• Multiple vulnerabilities in dnsmasq (WEOS-17-02) 2017-10-12
• Multiple vulnerabilities in MRD products (WEOS-15-08) 2017-08-14
• MSG_PEEK second checksum (WEOS-17-01) 2017-05-30

2016

• CVE-2015-7547 glibc getaddrinfo stack-based buffer overflow (WEOS-16-03) 2016-02-09

2015

• Multiple vulnerabilities in OpenSSL (update 1.0.1q) v1 (WEOS-15-07) 2015-12-04
• Default factory web interface certificate (WeOS-15-06) 2015-11-30