PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-36080 Westermo CVE debrief

A critical vulnerability in Westermo EDW-100 industrial serial-to-Ethernet converters exposes a hidden administrator account with hardcoded credentials. The root account password is embedded as plaintext strings within the firmware image.bin file, allowing trivial extraction by anyone with firmware access. No mechanism exists to change this password, rendering affected devices permanently vulnerable to unauthorized administrative access. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical) due to network attack vector, low complexity, no privileges required, and high impacts across confidentiality, integrity, and availability.

Vendor
Westermo
Product
EDW-100
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-30
Original CVE updated
2024-05-30
Advisory published
2024-05-30
Advisory updated
2024-05-30

Who should care

Industrial control system operators using Westermo EDW-100 serial-to-Ethernet converters in manufacturing, energy, transportation, and critical infrastructure environments; network security architects designing OT/IT boundary protections; asset owners implementing IEC 62443 security zones; incident response teams monitoring for unauthorized device access; procurement officers evaluating industrial networking equipment lifecycle and security posture.

Technical summary

The Westermo EDW-100 firmware package contains image.bin with hardcoded strings for username 'root' and its associated password. These credentials are exposed as plaintext strings trivially extractable through firmware analysis. The device provides no administrative interface or mechanism to modify or disable this account. Successful exploitation grants complete device control with no authentication barriers when network access is obtained. The vulnerability is inherent to the product design and cannot be patched; risk reduction requires compensating network and physical controls or product replacement.

Defensive priority

critical

Recommended defensive actions

  • Replace affected EDW-100 units with Westermo Lynx DSS L105-S1 as the vendor-recommended migration path
  • Implement network segregation and perimeter protection using firewalls and VLANs to isolate EDW-100 from untrusted networks
  • Deploy network-to-network protection such as VPNs for any data flows into or out of security zones containing EDW-100
  • Establish physical security controls including locked enclosures and tamper alarms to prevent physical access and firmware extraction
  • Apply IEC 62443 standard security zone and conduit modeling for industrial control system deployments
  • Monitor for unauthorized administrative connections to EDW-100 devices using network detection tools
  • Review and restrict remote access paths to EDW-100 management interfaces

Evidence notes

CISA ICS advisory ICSA-24-151-04 confirms the hardcoded credentials exist in firmware image.bin with username 'root' and extractable password strings. Vendor acknowledges no password change mechanism is available. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H validated by CISA.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-36080 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-36080

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-36080 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36080

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-151-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.