Westermo WeOS Denial-of-Service Vulnerability via Malformed ESP Packet

A denial-of-service vulnerability has been identified in Westermo WeOS versions 5.0 through 5.23.0. When the device is configured for IPSec, a malformed Encapsulating Security Payload (ESP) packet can be sent to the device, causing it to reboot immediately. This vulnerability disrupts the device's operation by forcing a reboot, which could be exploited as a denial-of-service attack.

Impact

Exploitation of this vulnerability causes the device to reboot, leading to a temporary disruption of service.

Remediation

Users are advised to upgrade to Westermo WeOS version 5.24.0 or later, which is available for download from the Westermo Network Technologies support site.