CVE-2025-54319

Executive Summary

CVE-2025-54319 is a medium-severity information disclosure vulnerability affecting Westermo WeOS 5, specifically versions 5.24 through 5.24.4. The flaw resides in the system logging functionality, where verbose syslog logging inadvertently includes sensitive credentials. A threat actor with local access to the device or log files can extract these credentials, leading to unauthorized access to sensitive information. The vulnerability has a CVSS score of 6.3, indicating a moderate risk, but the lack of a known patch and the potential for credential exposure elevates its importance for operational technology (OT) environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a firmware-level issue in Westermo WeOS, an embedded operating system for industrial networking equipment. The supply chain risk is limited to the direct procurement and deployment of Westermo devices running the affected firmware versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.3 (Medium)
• Attack Vector: Local (AV:L) – The attacker must have local access to the device or its log files.
• Attack Complexity: Low (AC:L) – No special conditions are required to exploit.
• Privileges Required: Low (PR:L) – The attacker needs basic access to the system or logs.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Credentials are fully disclosed.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the exposure of credentials in OT environments can lead to lateral movement and control of critical infrastructure.

Deep Dive & Mechanics

The vulnerability originates from the syslog configuration in Westermo WeOS 5. When verbose logging is enabled, the system logs authentication events, including usernames and passwords, in plaintext. This is a classic case of CWE-532: Insertion of Sensitive Information into Log File.

Root Cause: The logging subsystem does not sanitize or redact credentials before writing them to syslog. This is likely due to a development oversight where debug-level logging was left enabled in production firmware.

Attack Vector: An attacker with local access to the device (e.g., via SSH, console, or a compromised management interface) can read the syslog files. Alternatively, if syslog is forwarded to a remote server, the attacker could intercept the logs in transit or access the log server.

Impact: Once credentials are extracted, the attacker can authenticate to the device with elevated privileges, potentially gaining full control over the network equipment. This can lead to network segmentation bypass, traffic interception, or disruption of industrial processes.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the syslog configuration files or the logging daemon. A patched version would implement credential redaction.

Vulnerable Configuration (WeOS 5.24):

# /etc/syslog.conf (example)
*.* /var/log/messages
# Verbose logging enabled
auth.* /var/log/auth.log
# No redaction of credentials

Patched Configuration (Hypothetical):

# /etc/syslog.conf (example)
*.* /var/log/messages
# Verbose logging with credential redaction
auth.* /var/log/auth.log
# Use a filter to mask passwords
$template AuthLog,"%timegenerated% %HOSTNAME% %syslogtag% %msg:replace:password=[^ ]:password=***%"
auth.* ?AuthLog

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Westermo device running WeOS 5.24 to 5.24.4.
• Local access (SSH, console, or physical).

Steps:

1. Connect to the device via SSH or console.
2. Enable verbose logging if not already enabled:

   config
   logging verbose
   commit
   

3. Trigger an authentication event (e.g., login with a test user).
4. Read the syslog file:

   cat /var/log/messages | grep -i "password"
   

5. Extract credentials from the log output.

Example Output:

Jan 15 10:30:45 weos sshd[1234]: Failed password for admin from 192.168.1.100 port 22 ssh2
Jan 15 10:30:45 weos sshd[1234]: password: P@ssw0rd!

Blue Team

Detection:

• Monitor for unauthorized access to syslog files.
• Alert on any cat, grep, or tail commands targeting /var/log/messages or /var/log/auth.log.
• Use file integrity monitoring (FIM) to detect changes to log files.

Mitigation:

• Disable verbose logging if not required:

  config
  no logging verbose
  commit
  

• Restrict access to the device using ACLs and strong authentication.
• Forward logs to a secure, centralized log server with encryption.

Indicators of Compromise (IOCs)

• File Paths:
  • /var/log/messages
  • /var/log/auth.log
  • /var/log/syslog
• Log Patterns:
  • password: <plaintext>
  • Failed password for <user> from <IP>
• Network Traffic:
  • Syslog traffic (UDP 514) from the Westermo device to an external server.
• Commands:
  • cat /var/log/messages
  • grep -i password /var/log/*

Detection Engineering

YARA Rule

rule CVE_2025_54319_Westermo_Credential_Leak {
    meta:
        description = "Detects plaintext credentials in Westermo WeOS syslog files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-54319"
    strings:
        $cred1 = /password:\s*\S+/ nocase
        $cred2 = /Failed password for \S+ from \S+/ nocase
        $cred3 = /login:\s*\S+\s*password:\s*\S+/ nocase
    condition:
        any of them
}

Sigma Rule

title: Westermo WeOS Credential Leak in Syslog
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects plaintext credentials in Westermo WeOS syslog files
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - EventID: 1
          CommandLine|contains: 'password:'
        - EventID: 1
          CommandLine|contains: 'Failed password for'
    condition: selection
falsepositives:
    - Legitimate debugging sessions
level: high

Suricata Rule

alert udp $HOME_NET any -> $EXTERNAL_NET 514 (msg:"CVE-2025-54319 Westermo WeOS Credential Leak via Syslog"; content:"password:"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable verbose logging on all Westermo devices running WeOS 5.24 to 5.24.4:

   config
   no logging verbose
   commit
   

2. Rotate all credentials that may have been logged.
3. Review syslog files for any exposed credentials and revoke affected accounts.

Long-term Fix:

• Apply a firmware patch from Westermo when available.
• Implement log redaction at the application level.
• Use a centralized logging solution that filters sensitive data.

Workarounds:

• Restrict local access to the device using role-based access control (RBAC).
• Encrypt syslog traffic using TLS (e.g., via rsyslog with TLS).
• Monitor for unauthorized log access using the provided detection rules.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further analysis or remediation support, contact us at [valters@example.com].