CVE-2023-42765

Executive Summary

CVE-2023-42765 is a cross-site scripting (XSS) vulnerability in the web management interface of Westermo Lynx industrial networking devices. An attacker with access to the vulnerable software can execute arbitrary JavaScript in the context of an authenticated administrator's browser session by injecting a payload into the username parameter of the SNMP configuration. The vulnerability is rated CVSS 5.4 (Medium); no affected version range, CWE, or CVSS vector has been published, and no public exploit or CISA KEV listing currently exists, though the vendor has claimed a future fix.

Technical Analysis

The Westermo Lynx product family comprises industrial-grade Ethernet switches and routers deployed predominantly in operational technology (OT) and critical infrastructure environments. These devices expose a web-based management interface used for configuration of device services, including SNMP agent settings.

The flaw, as described in the NVD entry, resides in the SNMP configuration area of the web interface. The username parameter — the field used to define an SNMP user account (e.g., for SNMPv3 authentication) — is processed without adequate output encoding or input sanitization. This permits an attacker to "break out" of the parameter's intended data context and introduce attacker-controlled HTML or JavaScript into the rendered page. When an administrator subsequently views or loads the affected SNMP configuration view, the browser parses the injected content as active script rather than inert data, causing the payload to execute with the privileges of the logged-in session.

Several important caveats limit the available technical detail. The NVD description is sparse: no CWE identifier, no CVSS vector string, no affected version range, and no vulnerable endpoint path are provided. The CNA title ("Westermo Lynx Cross-site Scripting") confirms only the affected product family and the vulnerability class. Consequently, precise code-level attribution (specific source files, functions, or handler routines) is not possible from the data supplied. What can be stated with confidence is the mechanism class: an injection flaw in the web UI's handling of the SNMP username field leading to script execution in the management interface.

The phrase "attacker with access to the vulnerable software" in the NVD description implies that the attacker already holds some level of access to the device's web management plane — potentially an unauthenticated user able to reach the configuration form, or more plausibly an authenticated low-privilege user capable of submitting the SNMP configuration. The XSS impact is therefore concentrated on higher-privileged sessions (administrators) that render the poisoned page.

Given the EPSS score of 0.00294 (22nd percentile of all scored CVEs), the vulnerability is not currently trending in automated exploitation campaigns. The absence of a CISA KEV listing further corroborates that no confirmed in-the-wild exploitation has been catalogued as of the report date.

Exploitation Scenarios

No public PoC is available, and the attack chain below is therefore inferred from the vulnerability class and the NVD description. The assumed scenario involves an internal or external adversary targeting the web management plane.

1. Reconnaissance and target identification. The attacker identifies Westermo Lynx devices by scanning for web management interfaces (commonly running over HTTPS on industrial assets) or by using Internet-wide search engines such as Shodan with device-family fingerprints (e.g., "Westermo Lynx", product:"Westermo"). In OT environments, the attacker may already be positioned inside the production network segment after initial compromise of an adjacent host.

2. Triggering the flaw. The attacker gains access to the SNMP configuration view of the web interface — either directly if the page is reachable without authentication, or after authenticating with valid or stolen low-privilege credentials. They then populate the username parameter with a crafted XSS payload instead of a benign username string.

3. Payload and execution. At the vulnerability-class level, the injected string is stored or reflected by the application and rendered without proper encoding. A payload embedded in username — for example an HTML <script> block, an onerror event handler, or a javascript: URI — is stored as part of the SNMP user configuration. When an administrator opens the SNMP configuration page, the browser executes the JavaScript in the origin and context of the management web application, inheriting the administrator's session rights.

4. Post-exploitation impact. With script execution in the administrator's session, the attacker can exfiltrate session cookies or CSRF tokens, impersonate the administrator, modify other configuration parameters (e.g., SNMP community strings, trap receivers, or routing settings), and potentially pivot from the compromised device deeper into the OT network. Because Lynx devices sit on industrial control networks, a successful compromise of the management plane can enable lateral movement toward PLCs, RTUs, and other control-system assets.

Note: The absence of a public PoC and the sparse NVD description mean that specific endpoint paths, HTTP methods, and payload encoding details cannot be confirmed. The chain above is a class-level inference, not a reproduction of vendor-verified exploit mechanics.

Impact Assessment

The CVSS base score of 5.4 establishes this as a Medium-severity issue. Since the NVD record does not disclose the vector string, granular sub-scores (AV/AC/PR/UI/S/C/I/A) cannot be reconstructed; the medium score is nonetheless consistent with an XSS that requires some form of access to the software and results in integrity and confidentiality impacts within the web management plane.

The business impact must be considered in context. Westermo Lynx devices are industrial networking components used in power utilities, transportation, maritime, and manufacturing environments. Even a Medium-rated web flaw can become operationally significant when the target is a management interface that, if compromised, unlocks reconfiguration of a network segment carrying control-system traffic. The integrity impact (5.4 composite) is limited to the web UI layer and does not extend — per available data — to direct execution on the device's underlying operating system. However, an attacker who steals an administrator session can change device configuration, which carries indirect availability risks (e.g., disabling SNMP monitoring, altering VLANs, or disrupting management reachability).

Blast radius is bounded by network segmentation: devices whose management interfaces are exposed to the corporate network or the Internet are substantially more at risk than those confined to a dedicated management VLAN with strict ACLs. The lack of a confirmed patch increases operational exposure, since operators cannot currently close the flaw by upgrading to a known-fixed build.

Detection Guidance

The rules below are designed to detect exploitation attempts and post-exploitation traffic associated with CVE-2023-42765. Because the vulnerable parameter name (username) and the product family (Westermo Lynx) are the only confirmed technical identifiers, the rules anchor on those tokens in conjunction with generic XSS payload signatures. Adjust log sources to your environment's HTTP server logs (device web interface), proxies, and IDS.

Sigma Rule

title: Westermo Lynx SNMP Configuration Username XSS (CVE-2023-42765)
id: 8e2f0c73-9a4b-4d5c-9e7f-1a2b3c4d5e6f
status: experimental
description: >
  Detects cross-site scripting payloads in the username parameter of SNMP
  configuration requests to Westermo Lynx web management interfaces.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-42765
author: Valters IT Threat Intelligence
date: 2025/06/01
logsource:
  category: webserver
  definition: HTTP access logs from the Westermo Lynx management web server or an inline web proxy
detection:
  selection_parameter:
    cs-uri-query|contains:
      - "username="
  selection_payload_script:
    cs-uri-query|contains|all:
      - "<script>"
      - "alert("
  selection_payload_handler:
    cs-uri-query|contains:
      - "onerror="
      - "onload="
      - "javascript:"
  condition: selection_parameter and (selection_payload_script or selection_payload_handler)
fields:
  - c-ip
  - cs-uri-query
  - sc-status
  - cs-user-agent
falsepositives:
  - Authorized penetration testing activity
  - Web vulnerability scanners (e.g., Nessus, Burp)
level: high

YARA Rule

rule CVE_2023_42765_Westermo_Lynx_SNMP_Username_XSS
{
    meta:
        author      = "Valters IT Threat Intelligence"
        description = "Detects XSS payloads targeting the username parameter in Westermo Lynx SNMP configuration"
        cve         = "CVE-2023-42765"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2023-42765"
        date        = "2025-06-01"
        score       = 60

    strings:
        $s_user = "username=" ascii wide nocase
        $s_snmp = "SNMP" ascii wide nocase
        $s_script = "<script>" ascii wide nocase
        $s_js     = "javascript:" ascii wide nocase
        $s_err    = "onerror=" ascii wide nocase
        $s_alert  = "alert(" ascii wide nocase

    condition:
        $s_user and $s_snmp and any of ($s_script, $s_js, $s_err, $s_alert)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Westermo Lynx SNMP Username XSS Payload Inbound (CVE-2023-42765)"; flow:established,to_server; content:"username="; http_client_body; content:"SNMP"; http_client_body; content:"<script>"; http_client_body; sid:300042765; rev:1; metadata:created_at 2025_06_01, updated_at 2025_06_01;)

*Note: The rule inspects HTTP request bodies for the co-occurrence of the vulnerable parameter name, the "SNMP" configuration context, and a classic <script> payload. Adjust the http_client_body directive to http.uri if your deployment logs the payload in the query string rather than the POST body.)

Elastic Detection

any where event.category == "web"
  and url.query like "*username=*"
  and (url.query like "*<script>*"
       or url.query like "*javascript:*"
       or url.query like "*onerror=*"
       or url.query like "*onload=*")

This EQL rule matches web transactions in which the username parameter appears alongside common XSS payload markers in the URL query string. If your Elastic integration captures POST bodies in http.request.body.content, extend the rule with an or clause referencing that field (e.g., http.request.body.content like "*<script>*").

Splunk SPL Query

index=web sourcetype=access_combined
  (uri_query="*username=*" OR form_data="*username=*")
  AND (uri_query="*<script>*" OR form_data="*<script>*"
       OR uri_query="*javascript:*" OR form_data="*javascript:*"
       OR uri_query="*onerror=*" OR form_data="*onerror=*")
| stats count min(_time) max(_time) earliest(_time) latest(_time)
        by src, src_ip, dest, dest_ip, uri, uri_query, form_data, status, useragent
| sort - count

Wazuh OSSEC Rule

<group name="westermo,xss,">
  <rule id="100427" level="10" frequency="5" timeframe="120">
    <if_matched_sid>31100</if_matched_sid>
    <match>username=</match>
    <regex>\x3cscript\x3e|javascript:|onerror=|onload=</regex>
    <description>CVE-2023-42765 - Possible XSS payload in SNMP username parameter on Westermo Lynx web interface</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>westermo,xss,</group>
  </rule>
</group>

Note: The parent rule ID (31100) is an example anchor for web server log decoding; adjust if_matched_sid to the ID of the Apache/NGINX decoder rule already active in your Wazuh deployment.

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. The CNA (Westermo) states that the cross-site scripting issue "will be mitigated in a future report," but no concrete patch version or advisory URL has been independently confirmed. Treat the patch status as unverified and do not assume any current firmware build is immune.

1. Immediate mitigations (no patch available).

   • Restrict access to the web management interface using firewall rules, management ACLs, or dedicated management VLANs; allow only trusted administrative source IPs.
   • Disable the web/SNMP configuration service on Lynx devices if not strictly required for operations, reducing the attack surface as recommended by the vendor's hardening guidance.
   • Enforce strong, unique credentials for device administration and rotate them regularly. Because the vulnerability may be triggerable by any user with access to the SNMP configuration form, limit the number of accounts with configuration rights.
   • Segment OT networks from corporate and Internet-facing networks to prevent remote adversaries from reaching the management plane.

2. Patch and upgrade steps.

   • Monitor Westermo's official security advisory channel and the CNA record for the promised future mitigation. Re-evaluate this report's findings once the vendor releases a fixed firmware version.
   • Do not rely on the single-source patch claim; independently confirm the fixed version before planning a maintenance window, and test the upgrade in a staging environment replicating your OT network.
   • Where firmware cannot be updated promptly, apply compensating controls from Step 1 and document the residual risk.

3. Long-term hardening.

   • Adopt the vendor's published hardening best practices: disable unused services, restrict SNMP access to authorized management hosts, and use SNMPv3 with strong authentication where SNMP is required.
   • Implement centralized logging for all web management traffic to Lynx devices and enable the detection rules above in your SIEM/IDS stack.
   • Treat the web management plane of industrial equipment as a crown-jewel asset; place it behind a jump host or bastion with MFA and audit all administrative sessions.
   • Include device firmware updates in a recurring OT patch cycle, and subscribe to CVE feeds (NVD, CISA, vendor advisories) to catch future public disclosures early.

References

1. NVD — CVE-2023-42765: https://nvd.nist.gov/vuln/detail/CVE-2023-42765
2. CVE.org Record — CVE-2023-42765: https://www.cve.org/CVERecord?id=CVE-2023-42765
3. CNA: Westermo — Vendor advisory pending (the CNA states the XSS will be mitigated in a future report; no direct advisory URL was supplied in the intelligence data)
4. CISA Known Exploited Vulnerabilities Catalog — CVE-2023-42765 is NOT listed (KEV status: NO)
5. Threat activity: No known threat actor campaigns or exploit-in-the-wild evidence have been identified for this CVE as of this report; EPSS score 0.00294 (22nd percentile) indicates low current exploitation likelihood.

Report generated by Valters IT Threat Intelligence. This assessment is based exclusively on the CVE data provided; where source data was insufficient, class-level analysis is explicitly labeled as inferred and no implementation details have been fabricated.