CVE-2023-45222

Executive Summary

CVE-2023-45222 is a cross-site scripting (XSS) vulnerability in the web application of the Westermo Lynx family of industrial networking devices. An attacker with access to the device's web application can inject arbitrary JavaScript by placing an XSS payload into the autorefresh parameter, enabling client-side code execution in the context of an authenticated user's browser session. The flaw carries a CVSS base score of 5.4 (medium severity), no confirmed patch is currently available, and no known in-the-wild exploitation or CISA KEV listing has been recorded as of this report.

Technical Analysis

The vulnerability resides in the handling of the autorefresh parameter within the Westermo Lynx web management interface. According to the NVD description, the parameter does not sufficiently sanitize or encode attacker-controlled input before it is rendered back to the browser. When a victim loads a page that reflects the autorefresh value, an embedded payload is interpreted by the browser as executable JavaScript rather than inert data.

The affected component is the embedded web server/configurator bundled with the Lynx managed Ethernet switches and routers. Westermo Lynx devices are commonly deployed in industrial and OT (operational technology) networks — rail, utility, and process-automation environments — where the management interface is frequently accessed over the local network segment.

The root cause is a classic reflected or stored XSS pattern: user-supplied data (the autorefresh parameter) is emitted into the HTML document without context-aware output encoding. Because the input is a dedicated parameter of the device's own web application, no special network position beyond reachability to the management interface is required. The NVD description notes that the attacker "has access to the web application," implying the attacker can at minimum reach the HTTP/HTTPS management endpoint and craft malicious URLs or requests.

Specific source-code details, the affected code path, and the exact firmware versions are not disclosed in the available advisory data. Insufficient technical detail exists in public sources to name functions, classes, or endpoint paths beyond the autorefresh parameter itself. The vulnerability mechanism is nonetheless well understood at the class level: the application fails to validate and encode a reflected parameter, allowing script injection into a page rendered with the privileges of the logged-in user.

Exploitation Scenarios

1) Reconnaissance / target identification. An attacker first identifies Lynx devices exposed on the network. Shodan and similar search engines index devices by web banner and title (e.g., "Lynx", "Westermo"). In an OT environment, the attacker may already have a foothold on the management VLAN. The attacker queries the web application and locates a page that consumes the autorefresh parameter.

2) Flaw trigger. The attacker crafts a malicious URL of the form https://<lynx-device>/<page>?autorefresh=<payload>, substituting the autorefresh value with JavaScript. Typical payloads at the vulnerability-class level include <script>...</script>, event-handler injection (onerror=, onload=), or javascript: URI schemes. Because the parameter is reflected without sanitization, the payload is embedded verbatim in the response HTML.

3) Payload / execution. The crafted link must be visited by an authenticated user of the Lynx web application. Delivery vectors include spearphishing, embedding the link in an internal OT ticket system, or waiting for the device operator to click a manipulated bookmark. When the operator's browser renders the page, the injected script executes in the origin and session context of the device's web application.

4) Post-exploitation impact. Executing script in the user's session enables session-token theft (e.g., exfiltration of cookies to an attacker-controlled server), capture of credentials entered on spoofed dialogs, and manipulation of the rendered management UI. Because management pages may trigger state-changing operations (configuration writes, reboots, firmware actions), the script can also drive the authenticated browser to issue unauthorized configuration commands, effectively giving the attacker indirect control over the device's operational configuration.

Note: No public PoC exists for this CVE. The attack chain above is inferred from the documented vulnerability class and the autorefresh parameter named in the NVD description.

Impact Assessment

The CVSS base score of 5.4 reflects a medium-severity issue with a typical XSS impact profile: compromised confidentiality and integrity of data handled in the victim's session, no direct impact on device availability, and no privilege escalation into the underlying operating system of the switch.

The business impact is amplified by the product context. Westermo Lynx devices are hardened Ethernet infrastructure for rail, energy, and industrial networks. A successful XSS exploit can lead to:

• Session hijacking — an attacker steals authentication cookies and gains persistent, authenticated access to the switch's management interface.
• Operational disruption — via script-driven configuration changes (spanning-tree, VLAN, or port settings) that degrade network availability in OT segments.
• Lateral movement — the compromised management interface may expose routing information, neighbor device details, or network topologies that aid further intrusion.
• Regulatory/compliance risk — for rail-signaling and critical infrastructure operators subject to IEC 62443, NIS2, or TSA security directives.

The EPSS score of 0.00294 (21.9th percentile) indicates a low current probability of exploitation in the wild, and the CVE is not listed on CISA KEV. This suggests the vulnerability is not yet a recognized active attack vector, but the lack of a confirmed patch keeps the risk elevated for any organization with Lynx devices directly reachable from untrusted networks.

Detection Guidance

Detection of this vulnerability in transit is possible by inspecting HTTP request and response traffic for anomalous autorefresh parameter values containing scripting constructs. The rules below target the request side (payload delivery) and should be tuned to the organization's specific logging capacity. Note that HTTPS inspection (SSL/TLS termination) is required to see the payload in most deployments, as Lynx devices typically expose management over HTTPS.

Sigma Rule

title: Westermo Lynx autorefresh Parameter XSS Attempt
id: 3f2c7d1e-9b4a-4c6e-8f12-3a5b6c7d8e90
status: experimental
description: Detects HTTP requests to Westermo Lynx web applications containing script payloads in the autorefresh parameter (CVE-2023-45222).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45222
author: Valters IT Threat Intelligence
date: 2025-01-01
logsource:
    category: webserver
    product: generic
detection:
    selection_param:
        http.url|contains:
            - "autorefresh="
    selection_payload:
        http.url|contains|all:
            - "autorefresh="
        http.url|contains:
            - "<script"
            - "javascript:"
            - "onerror="
            - "onload="
            - "onmouseover="
            - "%3Cscript"
            - "%26%23"
    condition: selection_param and selection_payload
fields:
    - client.ip
    - server.ip
    - http.url
    - http.user_agent
falsepositives:
    - Legitimate use of autorefresh with non-script values (e.g., numeric refresh intervals)
level: high

YARA Rule

rule Westermo_Lynx_Autorefresh_XSS_CVE_2023_45222
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detect XSS payloads targeting the autorefresh parameter in Westermo Lynx web applications"
        reference = "CVE-2023-45222"
        severity = "medium"
    strings:
        $param = "autorefresh=" ascii nocase
        $p1    = "<script" ascii nocase
        $p2    = "javascript:" ascii nocase
        $p3    = "onerror=" ascii nocase
        $p4    = "onload=" ascii nocase
        $p5    = "document.cookie" ascii nocase
        $p6    = "%3Cscript%3E" ascii nocase
        $p7    = "&lt;script" ascii nocase
    condition:
        $param and any of ($p1, $p2, $p3, $p4, $p5, $p6, $p7)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any ( \
    msg:"CVE-2023-45222 Westermo Lynx autorefresh XSS attempt"; \
    flow:to_server,established; \
    http.uri; content:"autorefresh="; nocase; \
    content:"<script"; nocase; \
    or content:"javascript:"; nocase; \
    or content:"onerror="; nocase; \
    or content:"onload="; nocase; \
    metadata:created_at 2025-01-01; \
    reference:cve,2023-45222; \
    sid:21045222; rev:1;)

# Alternate rule for URL-encoded variants
alert http any any -> $HOME_NET any ( \
    msg:"CVE-2023-45222 Westermo Lynx autorefresh XSS attempt (encoded)"; \
    flow:to_server,established; \
    http.uri; content:"autorefresh="; nocase; \
    content:"%3Cscript"; nocase; \
    or content:"%253Cscript"; nocase; \
    or content:"%26%233c"; nocase; \
    metadata:created_at 2025-01-01; \
    reference:cve,2023-45222; \
    sid:21045223; rev:1;)

Elastic Detection

// EQL query for Elastic Security / Elasticsearch
// Detects HTTP requests with script payloads in the autorefresh parameter
any where
  network.protocol == "http" and
  url.query != null and
  url.query like~ "*autorefresh=*" and
  (
    url.query like~ "*<script*" or
    url.query like~ "*javascript:*" or
    url.query like~ "*onerror=*" or
    url.query like~ "*onload=*" or
    url.query like~ "*%3Cscript*" or
    url.query like~ "*document.cookie*"
  )

Splunk SPL Query

index=proxy OR index=web OR index=ids
  (url="*autorefresh=*" AND (url="*<script*" OR url="*javascript:*"
  OR url="*onerror=*" OR url="*onload=*" OR url="*%3Cscript*"
  OR url="*document.cookie*"))
| stats count min(_time) as first_seen max(_time) as last_seen
  by src_ip, dest_ip, dest_port, url, http_referrer
| where count > 0
| sort - count
| table _time, src_ip, dest_ip, dest_port, url, http_referrer, count

Wazuh OSSEC Rule

<group name="westermo_lynx,">
    <rule id="100452" level="10">
        <decoded_as>web</decoded_as>
        <description>CVE-2023-45222: Westermo Lynx autorefresh parameter XSS attempt</description>
        <match>autorefresh=</match>
        <regex>(\<script|javascript:|onerror=|onload=|document\.cookie|%3Cscript)</regex>
        <group>attack,xss,web_application_attack</group>
        <mitre>
            <id>T1059.007</id>
        </mitre>
        <info type="cve">2023-45222</info>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (the CNA, Westermo) claims a patch is forthcoming or exists, but this is not independently confirmed. The vendor advisory explicitly states the cross-site scripting issue "will be mitigated in a future report," indicating that no production-ready firmware fix is broadly available yet. Exercise caution before assuming a fix exists.

1) Immediate mitigations (no patch available):

• Restrict network access to the Lynx web management interface. Block HTTPS/HTTP management ports from all networks except trusted administrative jump hosts or dedicated management VLANs.
• Apply firewall/ACL rules on the switch's own access lists and upstream firewalls to limit source IPs that can reach the web UI.
• Disable the web service entirely if device configuration is performed via CLI, serial console, or a centralized network management system.
• Deploy a web application firewall (WAF) or reverse proxy in front of the management interface with XSS payload inspection rules similar to the detection rules above.
• Where possible, disable unused services on the device to reduce the overall attack surface, per the vendor's hardening recommendation.

2) Patch / upgrade steps:

• Monitor Westermo's official advisory and firmware download portal for a Lynx firmware release that addresses CVE-2023-45222.
• Independently verify the fix before deployment — the 2/4 patch confidence means the claimed patch should be tested in a lab against the exact autorefresh injection scenario.
• Validate firmware integrity (checksum/signature) before applying, and stage the upgrade through the vendor's supported procedure.
• Enforce administrative-session logout after each management session and validate HTTP response headers for Content-Security-Policy and X-XSS-Protection once upgraded.

3) Long-term hardening:

• Apply defense-in-depth per IEC 62443: segment OT networks, implement a deny-by-default policy for management interfaces, and require two-person control for configuration changes.
• Enable and audit all device logs; forward web-interface logs to a central SIEM/SOAR for correlation with the detection content above.
• Integrate Lynx device management into an identity-aware access layer (RADIUS/TACACS+) so that any XSS abuse of an authenticated session is bound to auditable credentials.
• Regularly re-assess the EPSS and CISA KEV lists for CVE-2023-45222; if the device becomes listed as exploited, reclassify the risk to critical and accelerate any patch or isolation action.

References

• NVD Entry — CVE-2023-45222: https://nvd.nist.gov/vuln/detail/CVE-2023-45222
• Westermo Security Advisory (CNA source, title: "Westermo Lynx Cross-site Scripting") — consult Westermo's official security advisories page for the current advisory and firmware status.
• MITRE ATT&CK — T1059.007 (Command and Scripting Interpreter: JavaScript): https://attack.mitre.org/techniques/T1059/007/
• MITRE CWE — CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2023-45222 is not listed as of this report; no in-the-wild exploitation evidence or known threat-actor campaign has been documented.