CVE-2024-32943 Westermo CVE debrief

Who should care

Organizations operating Westermo L210-F2G Lynx switches in industrial control system (ICS) or operational technology (OT) environments should prioritize assessment and mitigation. Network administrators responsible for securing critical infrastructure, SCADA engineers, and OT security teams managing remote access to field devices are directly affected. Organizations with externally exposed management interfaces or insufficient network segmentation face elevated risk. Compliance-focused entities in critical infrastructure sectors should evaluate this vulnerability against availability requirements and incident response preparedness.

Technical summary

The Westermo L210-F2G Lynx running firmware 4.21.0 is vulnerable to an unauthenticated network-based denial-of-service attack. The vulnerability is triggered by sending many SSH packets repeatedly, causing resource exhaustion or service disruption. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N). The CVSS 3.1 score of 7.5 reflects high impact to availability (A:H) with no impact to confidentiality or integrity. This vulnerability is particularly concerning for industrial environments where continuous availability of network infrastructure is critical for operational technology (OT) systems.

Defensive priority

HIGH

Recommended defensive actions

• Disable SSH access on external-facing communication interfaces to prevent remote exploitation of this denial-of-service vulnerability
• Restrict CLI access to trusted management networks only, implementing network segmentation for industrial control system devices
• Monitor for anomalous SSH connection patterns or high-volume packet flows targeting affected Westermo switches
• Apply vendor-recommended configuration changes to limit attack surface on production-deployed devices
• Subscribe to Westermo security advisories for future firmware updates that may provide comprehensive patches

Evidence notes

The vulnerability description and affected product version are derived from CISA CSAF advisory ICSA-24-172-03, which identifies Westermo L210-F2G Lynx firmware 4.21.0 as the affected product. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network accessibility and high availability impact with no authentication required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.