Security advisories
Security advisories are published for moderate and high-risk security issues related to Westermo products. To receive Westermo security advisory emails directly to your inbox, complete the form below.
If you were to experience any product security issues, we encourage you to contact our PSIRT team.
Published security advisories by year
2026
- Westermo 26-05: WeOS File Import - Improper Preservation of Permissions (CVE-2026-35385) 2026-05-26
- Westermo 26-04: WeOS ICMP - Denial-of-Service via Echo Reply (CVE-2025-47268) 2026-05-26
- Westermo 26-03: WeOS Management - Web Session Timeout Disabled by Using Multiple Tabs 2026-05-26
- Westermo-26-02: Merlin and Virtual Access GW Series OSPF Denial-of-Service 2026-05-12
- Westermo-26-01: Viper 3000 Bootloader Signature Verification Bypass 2026-03-31
2025
- Westermo-25-13: Improper Neutralization of Argument Delimiters in CLI 2025-11-03
- Westermo-25-12: Improper Limitation of Pathname in Configuration Export 2025-11-03
- Westermo-25-11: Improper Restriction of Communication Channel During Bootup 2025-10-16
- Westermo-25-10: Unsuccessful Routing of Traffic Through the IPSec Tunnel Interface 2025-10-16
- Westermo-25-09: RADIUS Server Groups Missing Encryption of Sensitive Data 2025-10-16
- Westermo-25-08: Sensitive Information in logging 2025-06-30
- Westermo-25-07: CVE-2025-46418 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 2025-06-30
- Westermo-25-06: Multiple vulnerabilities in EDW-100 & EDW-120 2025-06-23
- Westermo-25-01: HTTP Application Session Hijacking 2025-03-26
- Westermo-25-02: Malformed ESP packet could cause Denial 2025-03-26
- Westermo-25-05: Improper argument handling 2025-06-30
2024
- Westermo-24-09: Security Advisory regarding RADIUS/UDP vulnerability known as “Blast-RADIUS” 2024-11-18
- Westermo-24-11: Potential denial of service vulnerability in WeOS 2024-11-20
- Westermo-24-08: Potential arbitrary code execution vulnerability in WeOS 2024-11-20
- Westermo-24-15: Potential vulnerability in WeOS affecting link layer discovery protocol 2024-11-18
- Westermo-24-14: Vulnerability in software component zlib used by WeOS 2024-11-18
- Westermo-24-09: Security Advisory regarding RADIUS/UDP vulnerability known as “Blast-RADIUS” 2024-11-18
- Westermo-24-13: Possible vulnerability when reading configuration files in WeOS 2024-11-13
- Westermo-24-10: Potential denial-of-service vulnerability 2024-11-11
- Westermo-24-06: CVE-2021-36369 & CVE-2023-48795 - Vulnerability in SSH component of WeOS 2024-11-11
- Westermo-24-12: IbexOS Web Interface/WebAPI Session hijacking 2024-10-03
- Westermo-24-04: Exchange of sensitive information 2024-05-07
- Westermo-24-05: EDW-100 Security Advisory 2025-06-23
- Westermo-24-03: Unauthorized exposure of information through directory listing (Westermo 24-03) 2024-04-08
- Westermo-24-02: Code injection in web interface for WeOS products 2024-02-23
- Westermo-24-01: Vulnerabilities in web interface for WeOS products 2024-02-23
2023
2022
No security advisories issued
2021
- Eltec response to Log4j2 vulnerability related to OpenWRT (Eltec 21-01) 2021-12-20
- Westermo response to Log4j2 vulnerability related to xRD FW (Westermo 21-05) 2021-12-20
- Westermo response to Log4j2 vulnerability related to Ibex SW (Westermo 21-04) 2021-12-17
- Westermo response to Log4j2 vulnerability related to WeOS (Westermo 21-03) 2021-12-14
- Security Vulnerability in the wireless 802.11 implementation (Westermo 21-02) 2021-07-19
- Security Vulnerability in SSH (Westermo 21-01) 2021-02-09
2020
- Westermo Response to Ripple20 (Westermo 20-02) 2020-07-31
- Security Vulnerability in the PPP Package (Westermo-20-01) 2020-03-31
2019
No security advisories issued
2018
- LibSSH - Authentication Bypass Vulnerability (Westermo-18-05) 2018-11-26
- Vulnerabilities in BusyBox (Westermo-18-04) 2018-05-29
- Mongoose web server vulnerabilities (Westermo-18-03) 2018-05-29
- WeOS Vulnerable to Cross Site Request Forgery attack (Westermo-18-02) 2018-05-29
- Meltdown and Spectre (Westermo-18-01) 2018-01-05
2017
- WiFi key reinstallation attack (WEOS-17-03) 2017-10-17
- Multiple vulnerabilities in dnsmasq (WEOS-17-02) 2017-10-12
- Multiple vulnerabilities in MRD products (WEOS-15-08) 2017-08-14
- MSG_PEEK second checksum (WEOS-17-01) 2017-05-30
2016
2015
Security Vulnerability Management
Security vulnerability management is maintenance we do to keep our products secure over its lifetime, to ensure a high security standard and transparency towards our stakeholders. Threats evolve rapidly. By proactively managing vulnerabilities, we ensure our customers are informed, protected, and able to mitigate risks.
Nuri Shakeer
International Sales
Spørg mig om Security advisories
Andre måder at kontakte os på
Ved supporthenvendelser, klik her for at kontakte teknisk support