Westermo has released a permanent fix for the vulnerability reported in CVE-2017-14491 (WEOS-17-02) that affects WeOS releases 4.8.0 to 4.21.1.
An attacker would send a crafted DNS packet which could cause a buffer overflow in the underlying component. The effect of this attack would be a denial of service (DoS) or execution of arbitrary code (which potentially could give the attacker control of the component).
Organizations using any of the above WeOS versions are encouraged to upgrade to 4.21.2 to mitigate this vulnerability.
Alternative mitigation involves disabling use of the switch as a DHCP server and blocking of DNS requests following the instructions below:
- If the device acts as a DHCP server, remove all DHCP server configurations if present. See section 22.1.3 General DHCP Server settings in the WeOS Management Guide.
-
Block DNS requests by using the following firewall rule:
filter deny in <vlanX> dport 53 proto udp
For each VLAN in use, replace <vlanX> with the actual VLAN ID and apply the firewall rule. See section 31.1.2.2 Filter Rules Packet Matching in the WeOS Management Guide.
See the security advisory WEOS-17-02 in the Westermo Cyber Security resource center for more details about the vulnerability and how to mitigate:
