CVE-2024-35246 Overview
CVE-2024-35246 affects Westermo L210-F2G Lynx industrial switches running firmware version 4.21.0. An attacker on the network can trigger a denial-of-service condition by sending many packets repeatedly to the device. The flaw maps to [CWE-799: Improper Control of Interaction Frequency], indicating the device fails to throttle or rate-limit incoming traffic. Successful exploitation disrupts switch availability and degrades industrial network operations that depend on the affected hardware. CISA published the vulnerability in ICS Advisory ICSA-24-172-03.
Critical Impact
Unauthenticated remote attackers can disrupt availability of Westermo L210-F2G Lynx industrial switches by flooding the device with packets, impacting operational technology (OT) network uptime.
Affected Products
- Westermo L210-F2G Lynx firmware version 4.21.0
- Westermo L210-F2G Lynx hardware platform
- Industrial control networks using the affected switch as network infrastructure
Discovery Timeline
- 2024-06-20 - CVE-2024-35246 published to the National Vulnerability Database
- 2024-06-20 - CISA released ICS Advisory ICSA-24-172-03
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35246
Vulnerability Analysis
The vulnerability is a network-based denial-of-service condition in the Westermo L210-F2G Lynx managed industrial switch. The device does not adequately restrict the rate at which it accepts and processes network packets. When an attacker generates a sustained volume of packets directed at the switch, internal resources become exhausted and normal traffic processing degrades or halts.
The condition is reachable over the network without authentication and without user interaction. Only availability is impacted; the issue does not expose confidentiality or integrity of switch data. Because L210-F2G Lynx devices are deployed in industrial environments, loss of switching availability can cascade into broader OT outages affecting programmable logic controllers (PLCs), human-machine interfaces (HMIs), and SCADA systems sharing the segment.
Root Cause
The root cause is improper control of interaction frequency [CWE-799]. The firmware lacks sufficient rate-limiting or resource accounting for inbound packets. Sustained high-volume traffic consumes finite processing capacity faster than the device can release it, producing the denial-of-service state.
Attack Vector
An attacker with network reachability to the management or data plane of the switch sends a high volume of packets continuously. The traffic does not require valid credentials, special privileges, or operator interaction. Devices exposed beyond a segmented OT boundary, or reachable from a compromised host inside the industrial network, are at highest risk.
No verified proof-of-concept code is publicly available. See CISA ICS Advisory ICSA-24-172-03 for vendor-coordinated technical details.
Detection Methods for CVE-2024-35246
Indicators of Compromise
- Sudden drops in switch responsiveness, management plane timeouts, or loss of SNMP polling from L210-F2G Lynx devices.
- Spikes in inbound packet rates on switch interfaces that do not correlate with legitimate process traffic.
- Loss of connectivity between PLCs, HMIs, or SCADA endpoints connected through the affected switch.
Detection Strategies
- Baseline expected packet-per-second rates on each switch interface and alert on sustained deviations.
- Correlate switch availability telemetry, SNMP traps, and syslog with NetFlow or sFlow records to identify the upstream source of flooding traffic.
- Monitor for repeated short-lived connection floods originating from a single host or subnet inside the OT network.
Monitoring Recommendations
- Ingest switch syslog, SNMP, and flow data into a centralized analytics platform for cross-device correlation.
- Enable interface-level utilization and CPU-load alerting on the L210-F2G Lynx and adjacent switches.
- Track east-west traffic between IT and OT zones to detect lateral packet-flooding attempts targeting industrial infrastructure.
How to Mitigate CVE-2024-35246
Immediate Actions Required
- Identify all Westermo L210-F2G Lynx devices running firmware 4.21.0 across the environment and inventory their network exposure.
- Restrict network reachability to the switches so only authorized management hosts and required OT peers can send traffic.
- Apply firmware updates published by Westermo as referenced in CISA ICS Advisory ICSA-24-172-03.
Patch Information
Westermo has coordinated remediation through CISA. Refer to CISA ICS Advisory ICSA-24-172-03 for the current fixed firmware versions and vendor guidance. Apply the recommended firmware update during a planned maintenance window and validate switch behavior afterward.
Workarounds
- Place L210-F2G Lynx switches behind firewalls or industrial DMZs and block direct access from business networks and the internet.
- Apply upstream rate-limiting and storm-control on adjacent switches to cap packet rates reaching the vulnerable device.
- Segment OT networks following IEC 62443 zone-and-conduit guidance to limit blast radius from a compromised host.
- Disable unused services and management interfaces on the switch to reduce reachable attack surface.
# Configuration example: upstream rate-limiting and ACL restriction
# Restrict management access to a defined jump host
access-list 110 permit ip host 10.10.10.5 host 10.20.0.1
access-list 110 deny ip any host 10.20.0.1
access-list 110 permit ip any any
# Apply storm-control on the uplink facing the L210-F2G Lynx
interface GigabitEthernet0/1
storm-control broadcast level pps 1000
storm-control multicast level pps 1000
storm-control unicast level pps 5000
storm-control action shutdown
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
