CVE-2023-45735
📋 TL;DR
This vulnerability in Westermo Lynx devices allows attackers with device access to execute arbitrary code, potentially compromising device functionality. It affects organizations using these industrial networking devices, particularly in critical infrastructure sectors.
💻 Affected Systems
- Westermo Lynx devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to disruption of industrial operations, data exfiltration, or lateral movement within operational technology networks.
Likely Case
Local privilege escalation allowing attackers to modify device configurations, disrupt network communications, or install persistent backdoors.
If Mitigated
Limited impact if devices are properly segmented and access controls prevent unauthorized local access.
🎯 Exploit Status
Exploitation requires local access to the device; no public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Westermo security advisory for specific patched versions
Vendor Advisory: https://www.westermo.com/security-advisories
Restart Required: Yes
Instructions:
1. Check current device firmware version. 2. Download latest firmware from Westermo support portal. 3. Follow vendor's firmware update procedure. 4. Verify successful update and restart device.
🔧 Temporary Workarounds
Restrict Physical and Network Access
allLimit who can physically access devices and implement network segmentation
Implement Least Privilege Access
allEnsure only authorized personnel have administrative access to devices
🧯 If You Can't Patch
- Isolate vulnerable devices in separate network segments with strict firewall rules
- Implement continuous monitoring for unusual device behavior or configuration changes
🔍 How to Verify
Check if Vulnerable:
Check device firmware version against vendor's vulnerable version listCheck Version:
Device-specific command via serial console or web interface (consult device manual)Verify Fix Applied:
Confirm firmware version matches patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- Configuration changes without authorization
- Unusual login attempts
Network Indicators:
- Unexpected outbound connections from devices
- Anomalous traffic patterns
SIEM Query:
source="westermo-lynx" AND (event_type="config_change" OR event_type="reboot")