Westermo-25-07: CVE-2025-46418 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Severity: HIGH
Date: 2025-06-30
Description
Westermo has identified a vulnerability in WeOS 5 that potentially could be used to inject OS commands due to unsafe handling of media definitions.
Affected versions
- WeOS 5: Affects WeOS 5 version 5.23 and later.
- WeOS 4 is not affected.
Impact
The vulnerability described allows an attacker with administrative permissions to specify commands that would typically be inaccessible. This enables the execution of alternate commands with privileges beyond those granted to the attacker.
Severity
| Category | Details |
|---|---|
| Base score | The CVSS severity base score is 7.6 |
| Environmental | The CVSS environmental score is 6.3 |
| Vector string | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H/MAV:A/MS:U |
Mitigation
We recommend the following mitigations that do not require an update:
- Limit administration account access to trusted parties.
- Use best practices for passwords related to administration accounts.
Updates
Currently no update is available.
References
- WeOS - Westermo Operating System: Westermo
- CWE - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (4.17)
Revision History
Jun 30, 2025: Initial release
