CVE-2025-46418: Westermo WeOS OS Command Injection RCE

CVE-2025-46418 Overview

CVE-2025-46418 is an operating system (OS) command injection vulnerability [CWE-78] affecting Westermo WeOS 5, an industrial network operating system used in ruggedized switches and routers. The flaw resides in the handling of a media definition, where attacker-supplied input reaches an underlying shell context without sufficient validation. Versions of WeOS 5 starting from 5.24 are affected. Exploitation requires an authenticated high-privilege user and user interaction, but successful abuse compromises confidentiality, integrity, and availability across a scope boundary. The vulnerability is documented in CISA ICS Advisory ICSA-25-261-01.

Critical Impact

Successful exploitation permits arbitrary OS command execution on affected Westermo WeOS 5 devices, enabling attackers to pivot within operational technology (OT) networks.

Affected Products

• Westermo WeOS 5, versions 5.24 and later
• Industrial switches and routers running the affected WeOS 5 branch
• Deployments referenced in CISA ICS Advisory ICSA-25-261-01

Discovery Timeline

• 2026-09-02 - CVE-2025-46418 published to the National Vulnerability Database (NVD)
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2025-46418

Vulnerability Analysis

The vulnerability is an OS command injection weakness in the WeOS 5 media definition handling path. When the system processes a media definition, attacker-influenced fields are passed into a command context without adequate neutralization of shell metacharacters. This allows an authenticated operator to append or substitute arbitrary commands that execute in the underlying OS.

Because WeOS runs on industrial routing and switching hardware, command execution translates directly into control-plane compromise. Attackers can alter routing, disable interfaces, exfiltrate configuration data, or stage lateral movement into segmented OT networks. The scope-changed rating in the CVSS metadata indicates the injected commands operate beyond the originally authorized privilege boundary.

Root Cause

The root cause is missing or inadequate input sanitization in the media definition parser. User-supplied strings are concatenated into a shell command invocation rather than passed as isolated arguments to a safe execution API. Any metacharacter such as ;, |, `, or $() is interpreted by the shell rather than treated as literal data.

Attack Vector

Exploitation is network-reachable but requires authenticated high-privilege access to the device management interface and a user interaction step. An attacker with administrative credentials submits a crafted media definition containing embedded shell syntax. When the definition is applied or referenced, the injected commands execute with the privileges of the WeOS management process.

No verified proof-of-concept code is publicly available. Refer to CISA ICS Advisory ICSA-25-261-01 for vendor-supplied technical details.

Detection Methods for CVE-2025-46418

Indicators of Compromise

• Unexpected changes to media definitions or configuration objects on WeOS 5 devices running version 5.24 or later
• Configuration entries containing shell metacharacters such as ;, |, backticks, or $() inside media-related fields
• Unusual outbound connections initiated from management interfaces of Westermo switches or routers
• Administrative login events followed immediately by configuration writes to media definitions

Detection Strategies

• Baseline WeOS configuration snapshots and alert on drift within media definition sections
• Enable and centralize syslog from WeOS devices, then flag command strings inside configuration change events
• Correlate authentication events for high-privilege accounts with subsequent configuration modifications
• Apply CWE-78 detection heuristics that inspect device configuration payloads for embedded shell syntax

Monitoring Recommendations

• Forward WeOS syslog and audit trails into a centralized analytics platform for retention and correlation
• Monitor management-plane access (SSH, HTTPS, SNMP) to WeOS devices and restrict to known jump hosts
• Track privileged account usage on OT infrastructure and alert on out-of-window administrative sessions
• Review CISA ICS advisory updates for additional indicators tied to Westermo WeOS 5

How to Mitigate CVE-2025-46418

Immediate Actions Required

• Inventory all Westermo devices running WeOS 5 and identify hosts on version 5.24 or later
• Restrict management-plane access to WeOS devices to a dedicated administrative network segment
• Rotate and audit administrative credentials for WeOS devices, enforcing least privilege
• Review recent configuration changes for anomalous media definitions and revert suspicious entries

Patch Information

Consult CISA ICS Advisory ICSA-25-261-01 and the Westermo vendor security channel for the current fixed WeOS 5 release. Apply the vendor-supplied firmware update to all affected devices following change-management procedures for OT environments.

Workarounds

• Limit administrative access to WeOS management interfaces using network ACLs and firewall rules
• Disable unused management protocols and enforce strong, unique credentials for privileged accounts
• Segment OT networks so that a compromised WeOS device cannot reach unrelated control systems
• Increase logging verbosity and forward events to an external collector until patches are deployed

# Configuration example: restrict management access to WeOS devices
# Apply on upstream firewall - allow only jump host to reach device management
allow tcp from <jump-host-ip> to <weos-mgmt-ip> port 22
allow tcp from <jump-host-ip> to <weos-mgmt-ip> port 443
deny  tcp from any             to <weos-mgmt-ip> port 22
deny  tcp from any             to <weos-mgmt-ip> port 443