CVE-2025-46418 in WeOS
Summary
by MITRE • 09/02/2026
Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Westermo WeOS versions 5.x, specifically those beginning with version 5.24, represents a critical security flaw classified as an Operating System Command Injection. This type of vulnerability arises when software constructs system commands using input that has been supplied by an attacker without adequately sanitizing or validating the data. In this specific instance, the injection vector is located within the media definition configuration parameters. Media definitions in network devices typically dictate how the hardware interacts with various physical interfaces such as serial ports, fiber optic connections, or Ethernet links, defining properties like baud rates, parity settings, and flow control mechanisms. When an administrator configures these parameters through the device's management interface, the underlying firmware processes this input to generate internal configuration strings or shell commands that are executed by the operating system to apply the changes.
The technical root cause of this flaw lies in insufficient validation of user-supplied data within the media definition processing logic. If a malicious actor gains access to the administrative interface, either through stolen credentials, exploitation of another vulnerability, or physical access if authentication is weak or absent, they can craft specific input strings containing shell metacharacters such as semicolons, pipes, ampersands, or backticks. Because the system fails to properly escape these characters before passing them to a command interpreter like sh or bash on the embedded Linux-based OS of the device, the injected commands are executed with the privileges of the application running the configuration service. This typically results in execution under root-level permissions due to the privileged nature of network device management functions.
The operational impact of this vulnerability is severe and potentially catastrophic for affected infrastructure. An attacker who successfully exploits this command injection can execute arbitrary operating system commands on the target device. This capability allows for complete compromise of the network element, enabling the adversary to read sensitive configuration files containing credentials or encryption keys, modify routing tables to facilitate traffic interception or denial of service attacks, install persistent backdoors for long-term access, and pivot into other parts of the internal network by using the compromised device as a foothold. Since Westermo devices are frequently deployed in industrial control systems (ICS) and critical infrastructure environments where reliability is paramount, such an exploit could disrupt operational technology processes leading to significant financial loss or safety hazards.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps to the MITRE ATT&CK framework under techniques related to Execution and Persistence, specifically T1059 Command and Scripting Interpreter for initial execution and potentially T1546 Event Triggered: GUI Application or similar mechanisms if it involves modifying startup scripts via command injection. The attack vector is generally classified as Network-based with High complexity if remote authentication bypasses are required first, but Local Access if physical access allows direct console interaction without strong authentication.
Mitigation strategies for this vulnerability primarily involve applying the latest firmware updates provided by Westermo that address the input validation flaws in the media definition handling code. Organizations should ensure their network management systems enforce strict role-based access control to limit who can modify device configurations. Additionally, implementing network segmentation to isolate critical infrastructure devices from general corporate networks reduces the attack surface for remote exploitation. If immediate patching is not feasible, administrators should disable unused administrative interfaces and employ strong authentication mechanisms such as multi-factor authentication where supported by the hardware revision. Regular vulnerability scanning of management planes and monitoring logs for unusual command execution patterns can also aid in early detection of attempted exploits.