CVE-2025-46418: OS Command Injection
Published Sep 2, 2026
·Updated
Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.
Affected Software
2 affected components
Westermo WeOS>=undefined
: Westermo Network Technologies WeOS 5>=5.24
Event History
Sep 2, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via ICS·04:37 AM
SeverityWeaknessAffected Software
Frequently Asked Questions
1
What access and user interaction are required for exploitation?
The vector indicates network reachability, but exploitation has high attack complexity, requires high privileges, and requires user interaction. An attacker would need to use a media definition as the command-injection path.
2
Which deployments are known to be affected?
The affected product information identifies Westermo WeOS 5.x starting from version 5.24. The provided data does not identify unaffected versions, fixed versions, or whether the vulnerable functionality is enabled by default.
3
What is the potential impact if exploitation succeeds?
Successful exploitation can result in high confidentiality, integrity, and availability impact. The scope is changed, indicating impacts may extend beyond the initially affected security authority.