CVE-2015-7923
📋 TL;DR
This vulnerability allows man-in-the-middle attackers to decrypt SSL/TLS communications on Westermo WeOS devices because all installations used the same hardcoded private key. Any organization using affected WeOS versions is vulnerable to intercepted and decrypted network traffic.
💻 Affected Systems
- Westermo WeOS
📦 What is this software?
Weos by Westermo
⚠️ Risk & Real-World Impact
Worst Case
Complete decryption of all SSL/TLS traffic, credential theft, session hijacking, and unauthorized access to industrial control systems.
Likely Case
Interception and decryption of sensitive data transmitted over SSL/TLS, potentially exposing credentials and operational data.
If Mitigated
Limited impact if network segmentation prevents man-in-the-middle positioning or if alternative encryption methods are used.
🎯 Exploit Status
Attack requires man-in-the-middle positioning but no authentication. The hardcoded key is publicly known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.19.0 and later
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-16-028-01
Restart Required: Yes
Instructions:
1. Download WeOS version 4.19.0 or later from Westermo support portal. 2. Backup current configuration. 3. Upload and install the new firmware. 4. Reboot the device. 5. Generate new unique SSL certificates.
🔧 Temporary Workarounds
Replace SSL certificates
allGenerate and install unique SSL certificates for each device to replace the hardcoded key.
openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout device.key -out device.crt
Network segmentation
allIsolate WeOS devices in separate VLANs with strict access controls to limit man-in-the-middle opportunities.
🧯 If You Can't Patch
- Isolate affected devices in dedicated network segments with strict firewall rules
- Implement VPN tunnels for all communications to/from affected devices
🔍 How to Verify
Check if Vulnerable:
Check WeOS version via web interface or CLI. If version is below 4.19.0, device is vulnerable.Check Version:
show versionVerify Fix Applied:
Verify version is 4.19.0 or higher and check that SSL certificates are unique (not the default hardcoded key).📡 Detection & Monitoring
Log Indicators:
- SSL/TLS handshake failures
- Certificate validation errors
- Unexpected certificate changes
Network Indicators:
- SSL/TLS traffic interception attempts
- Certificate fingerprint matches known vulnerable key
SIEM Query:
source="weos" AND (event="ssl_error" OR event="certificate_error")