Description

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-02T05:17:10.760Z",
  "pubdate": "2026-09-02T05:17:10.760Z",
  "executiveSummary": "This vulnerability is an OS command injection flaw identified in Westermo WeOS versions starting from 5.24. The issue arises from the improper sanitization of input provided within media definition fields, allowing an authenticated attacker to inject and execute arbitrary operating system commands with elevated privileges.\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected industrial networking devices. By successfully exploiting this flaw, an attacker can gain unauthorized remote code execution capabilities on the underlying operating system.\nThe attack is contingent upon the attacker having access to the device management interface. Given the nature of WeOS deployments in critical infrastructure, successful exploitation could lead to full system compromise, persistent backdoor installation, or lateral movement within the operational technology (OT) environment. There are no known mitigations that do not involve vendor-supplied security patches or strict configuration hardening.",
  "technicalDetails": "The root cause of this vulnerability is an injection flaw within the handling of media definition parameters in Westermo WeOS 5.x. The affected component fails to validate or sanitize user-supplied input before passing it to a system-level shell or execution context. This allows an attacker to break out of the intended application logic and execute arbitrary system binaries.\nExploitation is typically achieved by injecting shell metacharacters—such as semicolons, backticks, or pipes—into the media definition configuration fields. When the application processes the user-defined media configuration, the underlying backend infrastructure interprets these metacharacters as delimiters or command separators, subsequently executing the attacker's payload as a sub-process of the web application or the management service.\nThe attack flow proceeds as follows: First, the attacker accesses the device's web management interface or API. Second, the attacker interacts with the media definition settings page, where they insert a malicious payload specifically crafted to include system commands (e.g., 'cat /etc/shadow' or reverse shell directives). Third, the attacker submits or saves the configuration. Fourth, the application triggers a backend operation that invokes the vulnerable function, which parses the tainted media definition string. Finally, the OS executes the injected command sequence with the privileges of the service user, which often possesses sufficient permissions to perform administrative actions.\nThe vulnerable component resides in the configuration management subsystem responsible for media definitions. While specific authentication requirements were not explicitly detailed, such administrative configuration changes generally require authenticated access with administrative or high-level privileges. However, if the interface is exposed to the network, the management plane is effectively the attack surface. Post-exploitation, an attacker can manipulate system files, extract sensitive credentials, disable security controls, or establish persistent unauthorized access, thereby compromising the entire node within the network topology. The scope of impact is limited to systems running WeOS 5.24 and subsequent iterations until a vendor-supplied patch is applied."
}