CVE-2024-35246 Westermo CVE debrief

Who should care

Organizations operating Westermo L210-F2G Lynx industrial Ethernet switches in critical infrastructure environments, including manufacturing, energy, transportation, and utility sectors. Security teams responsible for industrial control system (ICS/SCADA) network security, network administrators managing OT/IT convergence, and compliance officers addressing NERC CIP or IEC 62443 requirements should prioritize assessment and mitigation of this vulnerability. The unauthenticated, network-based attack vector makes this particularly relevant for externally exposed or poorly segmented industrial networks.

Technical summary

The Westermo L210-F2G Lynx (version 4.21.0) contains a denial-of-service vulnerability that can be triggered by an unauthenticated remote attacker sending many packets repeatedly. The vulnerability is remotely exploitable over the network with low attack complexity. The CVSS 3.1 score of 7.5 reflects high availability impact with no confidentiality or integrity impact. CISA's advisory indicates the vulnerability affects HTTP/HTTPS WebGUI access and SSH CLI access, with attack vectors including repeated login attempts. The vendor has provided mitigation guidance focused on access restriction and protocol hardening rather than a software patch at this time.

Defensive priority

HIGH

Recommended defensive actions

• Disable HTTP access to the WebGUI and use HTTPS instead to secure credentials and session IDs
• Disable access to the device's WebGUI on external communication interfaces; for production environments, disable the WebGUI if possible
• Limit access to the device's CLI on external communication interfaces to prevent SSH denial-of-service attacks through repeated login attempts
• Monitor for vendor updates as Westermo has committed to keeping users informed of further enhancements
• Apply network segmentation to limit exposure of industrial control system devices to untrusted networks
• Implement intrusion detection systems to identify anomalous traffic patterns indicative of denial-of-service attempts

Evidence notes

The vulnerability description and affected product information are derived from CISA's CSAF-formatted advisory (ICSA-24-172-03), which identifies Westermo L210-F2G Lynx version 4.21.0 as the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network-based, unauthenticated exploitation resulting in availability impact only.

Official resources