CVE-2023-45227

Executive Summary

CVE-2023-45227 is a cross-site scripting (XSS) vulnerability in the web application of Westermo Lynx industrial networking devices. An attacker with access to the device's web application can inject arbitrary JavaScript into the "dns.0.server" parameter, which then executes in the context of the management interface. Successful exploitation can lead to session hijacking, unauthorized configuration changes, and lateral movement within industrial (OT/ICS) networks. The vulnerability has a CVSS base score of 5.4 (Medium), is not listed in the CISA KEV catalog, and no public exploit code or PoC has been identified at the time of writing.

Technical Analysis

The vulnerability is a cross-site scripting flaw (vulnerability class CWE-79) residing in the web-based management interface of the Westermo Lynx product family. The CNA title explicitly names "Westermo Lynx" and describes the flaw as a cross-site scripting issue. The NVD description states that:

"An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter."

From a vulnerability-mechanism standpoint, this is an insufficient input validation / output encoding failure. The dns.0.server parameter appears to be a configuration field used by the device's DNS client settings within the management web application. When a user or administrator submits a value for this parameter, the web application processes it without properly sanitizing or encoding malicious content. A payload such as a <script> block or an event-handler attribute (e.g., onerror=, onload=) is subsequently rendered by the browser in the context of the management application's origin, allowing arbitrary JavaScript execution.

Key technical details and constraints:

• Attack surface: The Lynx web management interface. Because the parameter belongs to a device configuration subsystem (dns.0.server), the affected page is most plausibly the network/DNS configuration view. The attacker needs some level of access to the web application — the exact pre-conditions (unauthenticated vs. low-privileged authenticated access) are not disclosed in the available data.
• Injection vector: The dns.0.server parameter, likely submitted via an HTTP GET or POST request when the configuration form is saved/updated.
• Execution context: The victim's browser, in the security context (origin) of the Lynx management web application, meaning the injected JavaScript inherits whatever privileges the logged-in management user has.
• CWE / MITRE mapping: The MITRE CWE entry is listed as N/A in the source data, but the CNA title confirms the XSS class, mapping to CWE-79. The MITRE ATT&CK technique is T1059.007 (Command and Scripting Interpreter: JavaScript).
• Affected versions: Not disclosed. The "Affected Versions" list is empty in the source data, so it is impossible to enumerate specific firmware versions that are vulnerable or patched. Insufficient technical detail is available to identify exact affected builds.
• Patch status: The CNA claims a fix will arrive in a future security report, but this is not independently confirmed (patch confidence 2/4). There is no vendor-fix version in the source data.

No additional technical specifics (function names, code snippets, or file paths) are provided in the NVD description beyond the parameter name, so the attack mechanism is described at the vulnerability-class level.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE; the attack chain below is therefore inferred from the vulnerability class (stored/reflected XSS via a configuration parameter) and the sparse NVD description.

1. Reconnaissance / target identification: An attacker identifies Westermo Lynx devices with an exposed web management interface. This can be done via internet-wide scanning (e.g., Shodan queries such as title:"Westermo" or "Westermo Lynx"), or, more commonly in OT environments, from a foothold already established inside the corporate/ICS network. The attacker then determines that the device's web application is accessible and that the DNS configuration section (containing the dns.0.server field) is reachable.

2. Triggering the flaw: The attacker navigates to the DNS configuration page of the Lynx web application and submits a crafted value for the dns.0.server parameter. The web application accepts the input without adequate sanitization and either reflects it immediately (reflected XSS) or stores it in the device configuration so it is rendered when the page is reloaded (stored XSS). The NVD description does not specify which type applies; the parameter name suggests a persisted configuration value, which leans toward stored XSS.

3. Payload / execution method: The attacker injects a canonical XSS payload at the vulnerability-class level — for example, an HTML <script> element, a javascript: URI, or an event-handler attribute such as onerror= or onload= — embedded within the value of dns.0.server. When a legitimate administrator opens or refreshes the affected configuration page, the browser parses and executes the payload in the context of the Lynx web application's origin.

4. Post-exploitation impact: The injected JavaScript executes with the privileges of the logged-in management user's session. Realistic post-exploitation actions include: stealing session cookies/tokens and performing session hijacking; silently modifying device configuration (DNS settings, management access controls, routing) through the web UI's legitimate functions invoked via the injected script; and using the compromised management session as a pivot point to reach other OT assets on the management network. Because Lynx devices are industrial Ethernet switches/routers, an attacker who gains the management session could disrupt network segmentation or redirect traffic by altering device configuration.

Impact Assessment

The CVSS base score is 5.4 (Medium), though no vector string was disclosed, which limits sub-score analysis. A medium score is consistent with an XSS vulnerability that requires some degree of access to the web application and typically affects confidentiality and integrity rather than availability directly.

• Business impact: Westermo Lynx devices are commonly deployed in industrial automation, transportation, power/utilities, and other mission-critical OT environments. A successful XSS attack against the management interface can lead to loss of integrity of device configuration, disclosure of session credentials, and disruption of managed network services if the attacker alters routing/security settings.
• Affected systems: Westermo Lynx series products running vulnerable firmware (specific versions not disclosed in the source data). The vulnerability affects the web-based management application only; the data-plane switching/routing function is not directly exploited by XSS.
• Blast radius: The management network segment. If the web UI is exposed to the corporate network or the internet, the blast radius expands accordingly. In a segmented OT architecture (per IEC 62443 zones/conduits), the blast radius is typically limited to the management zone, but the device's role as a network infrastructure component means the downstream impact on operational communications could be significant (e.g., a compromised management session allows an attacker to reconfigure VLANs or ACLs).
• Exploitability factors: EPSS score is very low (0.00294, 21.9th percentile of exploited CVEs), indicating the vulnerability is unlikely to be exploited in the wild in the near term. The CISA KEV catalog does not list this CVE, and no threat-actor campaigns or in-the-wild exploitation evidence were identified in the source data.

Detection Guidance

The detection rules below focus on the only concrete technical indicator disclosed in the NVD description: the literal dns.0.server parameter combined with typical XSS payload markers (<script>, javascript:, onerror=, onload=, alert(, etc.). These rules assume the availability of HTTP web-access logs or network capture of traffic to the Lynx management interface.

Sigma Rule

title: Westermo Lynx dns.0.server XSS Injection Attempt
id: 1b5b7c64-2a3d-4f8e-9c10-4f5a6b7c8d90
status: experimental
description: Detects HTTP requests to Westermo Lynx web management interfaces that include the dns.0.server parameter combined with cross-site scripting payload indicators (CVE-2023-45227).
author: Valtersit Threat Intelligence
date: 2025/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-45227
logsource:
    category: webserver
    product: generic
detection:
    selection_param:
        - cs-uri-query|contains: "dns.0.server"
        - request_body|contains: "dns.0.server"
    selection_payload:
        - cs-uri-query|contains:
            - "<script>"
            - "javascript:"
            - "onerror="
            - "onload="
            - "alert("
        - request_body|contains:
            - "<script>"
            - "javascript:"
            - "onerror="
            - "onload="
            - "alert("
    condition: selection_param and selection_payload
falsepositives:
    - Legitimate administrators testing input fields with benign values that happen to contain these substrings
level: high
tags:
    - attack.t1059.007
    - cve.2023-45227
    - xss

YARA Rule

rule Westermo_Lynx_XSS_dns0_server
{
    meta:
        author      = "Valtersit Threat Intelligence"
        description = "Detects web traffic or log lines containing an XSS payload in the Westermo Lynx dns.0.server parameter (CVE-2023-45227)."
        cve         = "2023-45227"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2023-45227"
        date        = "2025-01-01"
    strings:
        $param = "dns.0.server" ascii
        $s1    = "<script>" ascii
        $s2    = "javascript:" ascii
        $s3    = "onerror=" ascii
        $s4    = "onload=" ascii
        $s5    = "alert(" ascii
        $s6    = "onmouseover=" ascii
        $s7    = "%3Cscript%3E" ascii   /* URL-encoded <script> */
        $s8    = "%3C/script%3E" ascii  /* URL-encoded </script> */
    condition:
        $param and any of ($s*)
}

Note: This YARA rule is intended for scanning network captures (PCAP), HTTP access logs, or WAF/IDS alert dumps. The $param string anchors the match to the vulnerable parameter; any of the payload strings narrows the match to a likely XSS attempt. URL-encoded variants (%3Cscript%3E) are included because HTTP request bodies may be captured in encoded form.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-45227 - Westermo Lynx dns.0.server XSS Injection Attempt"; flow:to_server,established; content:"dns.0.server"; http.uri; content:"dns.0.server"; http.request_body; pcre:"/<script|javascript:|onerror\s*=|onload\s*=|alert\s*\(/i"; reference:cve,2023-45227; classtype:web-application-attack; sid:202345227; rev:1;)

Rule notes: The rule inspects both the HTTP URI and the request body for the dns.0.server parameter, and requires at least one common XSS signature in the same request (script tag, javascript: scheme, event handlers, or alert()). Adjust $HOME_NET to the management network segment containing the Lynx devices. Test carefully to minimize false positives from legitimate firmware-update or monitoring traffic.

Elastic Detection

network where event.category == "web" and network.protocol == "http"
  and (
    http.request.body.text like "*dns.0.server*"
    or url.path like "*dns.0.server*"
    or url.query like "*dns.0.server*"
  )
  and (
    http.request.body.text like "*<script>*"
    or http.request.body.text like "*javascript:*"
    or http.request.body.text like "*onerror=*"
    or http.request.body.text like "*onload=*"
    or url.query like "*<script>*"
    or url.query like "*javascript:*"
  )

Note: Field names (http.request.body.text, url.path, url.query, event.category) follow the Elastic Common Schema (ECS) conventions for HTTP/web traffic. Adjust to your index mapping if using a different dataset (e.g., Apache/IIS access logs via Filebeat). The query triggers on any HTTP request that references the dns.0.server parameter and contains an XSS payload marker.

Splunk SPL Query

index=proxy OR index=web OR index=suricata OR sourcetype=access_combined
  "dns.0.server"
  ("<script>" OR "javascript:" OR "onerror=" OR "onload=" OR "alert(")
| eval cve="CVE-2023-45227"
| table _time, src_ip, dest_ip, dest_port, url, http_method, user_agent, status
| sort - _time

Note: The first search clause matches the vulnerable parameter in the URL or request body (depending on which fields your proxy/web index captures); the second clause narrows to requests carrying XSS payload signatures. Include sourcetype=stream:http or similar if your Splunk deployment ingests raw HTTP traffic.

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100452" level="12">
    <decoded_as>web-log</decoded_as>
    <regex>dns\.0\.server.*(&lt;script|javascript:|onerror=|onload=|alert\()</regex>
    <description>CVE-2023-45227: Westermo Lynx XSS injection attempt detected in dns.0.server parameter.</description>
    <mitre>
      <id>1059.007</id>
    </mitre>
    <group>web_application_attack,xss,cve-2023-45227,</group>
  </rule>
</group>

Note: The decoded_as value should match the Wazuh decoder used for your web server access logs (e.g., web-log for Apache, iis for IIS, or wazuh-decoder-http for a custom HTTP decoder). The regex is applied to the raw log line; the < entity is used for XML escaping of <. Adjust the decoder name to your deployed Wazuh configuration.

Mitigation & Patch Guidance

Patch confidence: 2/4 — a patch is CLAIMED by a single source (the CNA) but is not independently confirmed, and no fixed version number has been published. The vendor states the XSS will be mitigated "in a future report."

1. Immediate mitigations (no patch available yet):

   • Restrict access to the web management interface. Apply firewall/ACL rules so that only trusted administrative workstations on a dedicated management VLAN can reach the Lynx web application. Do not expose the management UI to the corporate LAN or the internet.
   • Disable the web management service if it is not strictly required for operations, and use out-of-band management (serial console or CLI) instead where possible.
   • Follow Westermo's published hardening guidance, which the CNA workaround text explicitly recommends: restrict access, disable unused services (attack surface reduction), and limit network exposure of the device.
   • Deploy a WAF or reverse proxy in front of the management interface with XSS-filtering rules that block requests containing dns.0.server combined with script/event-handler payloads, until the vendor fix is applied.

2. Patch / upgrade steps:

   • Monitor Westermo's official security-advisory channel and the CNA record for the forthcoming fix (tracked under CVE-2023-45227).
   • Because the affected version range is undisclosed, inventory all Westermo Lynx devices in your environment and record their current firmware versions so you can rapidly identify which units require upgrading when the advisory and patched firmware are released.
   • Validate patch integrity (checksum) and test the firmware update in a staging/lab environment before production rollout, per standard OT change-management procedures.

3. Long-term hardening:

   • Enforce network segmentation per IEC 62443 / ISA-99 zones and conduits so that ICS device management interfaces are isolated from general IT traffic.
   • Implement strong authentication (and MFA where the device supports it) for all management-interface users, and review default credentials.
   • Centralize web/management access logging and feed the logs into your SIEM (e.g., Splunk, Wazuh, Elastic) using the detection guidance above.
   • Periodically review the CISA KEV catalog and EPSS data for this CVE; although currently unlisted with a very low EPSS score, its status may change if in-the-wild exploitation is observed.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-45227 — Official NVD record containing the description, CVSS base score (5.4), and CNA reference for this vulnerability.
2. MITRE CVE Record: https://www.cve.org/CVERecord?id=CVE-2023-45227 — CVE.org record issued by the Westermo CNA, titled "Westermo Lynx Cross-site Scripting."
3. Westermo (CNA) vendor advisory: The vendor claims a patch is forthcoming ("will be mitigated in a future report") and recommends hardening best practices. No public advisory URL or patched version number was provided in the source data.
4. CISA Known Exploited Vulnerabilities (KEV) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2023-45227 is not listed; no known exploitation in the wild per KEV and no evidence of threat-actor campaigns was identified in the available data.

PoC / exploit status: No public proof-of-concept, Nuclei template, or exploit code is available for this CVE as of this report. Detection guidance above is based on the vulnerability class (XSS via the disclosed dns.0.server parameter) and should be treated as hypothesis-driven until a public PoC or vendor advisory with further detail is released. Insufficient technical detail is available to enumerate exact affected firmware versions.