CVE-2023-45735 Westermo Lynx Code Injection
An attacker with device access can execute malicious code, compromising the correct functioning of Westermo Lynx devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-45735?
CVE-2023-45735 is a high-severity code injection vulnerability in Westermo Lynx, published on 6 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.
Weakness: CWE-94
Which versions are affected by CVE-2023-45735?
It affects 1 product.
Products include Westermo L206-F2g Firmware.
How do I fix CVE-2023-45735?
No fix has been published for CVE-2023-45735 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-45735 being exploited?
There is no known exploitation of CVE-2023-45735 in the wild and no public exploit code.
Other vulnerabilities in Westermo Lynx
- CVE-2023-38579 Westermo Lynx 206-F2G Cross-Site Request Forgery
- CVE-2023-45213 Westermo Lynx Permissive Cross-domain Policy with Untrusted Domains
- CVE-2023-40544 Westermo Lynx Cleartext Transmission of Sensitive Information
- CVE-2023-40143 Westermo Lynx
- CVE-2023-42765 Westermo Lynx Cross-site Scripting
Sources
Also known as GHSA-48gj-6976-qj95.