Multiple vulnerabilities in Westermo EDW-100



Risk High
Patch available NO
Number of vulnerabilities 2
CVE-ID CVE-2024-36080
CVE-2024-36081
CWE-ID CWE-259
CWE-522
Exploitation vector Network
Public exploit N/A
Vulnerable software
 EDW-100
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor Westermo

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Use of Hard-coded Password

EUVDB-ID: #VU91251

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2024-36080

CWE-ID: CWE-259 - Use of Hard-coded Password

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to use a hard-coded password in "image.bin". A remote attacker can bypass authentication requirements.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

EDW-100: All versions

CPE2.3 External links

http://www.westermo.com/-/media/Files/Cyber-security/westermo_sa_EDW-100_24-05.pdf
http://www.cisa.gov/news-events/ics-advisories/icsa-24-151-04


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Insufficiently protected credentials

EUVDB-ID: #VU91252

Risk: Medium

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2024-36081

CWE-ID: CWE-522 - Insufficiently Protected Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficiently protected credentials. A remote attacker can download the configuration-file that contains the configuration, username and passwords in cleartext.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

EDW-100: All versions

CPE2.3 External links

http://www.westermo.com/-/media/Files/Cyber-security/westermo_sa_EDW-100_24-05.pdf
http://www.cisa.gov/news-events/ics-advisories/icsa-24-151-04


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###