CVE-2025-46418: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Westermo WeOS

Westermo WeOS 5.x starting from version 5.24 contains an OS command injection vulnerability (CWE-78) that can be triggered through a media definition. This vulnerability allows an attacker with high privileges and requiring user interaction to execute arbitrary operating system commands, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 7.6, indicating high severity. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to full compromise of the affected device, including unauthorized command execution with high privileges, resulting in complete loss of confidentiality, integrity, and availability. The vulnerability requires user interaction and high privileges, which limits the attack vector but still poses a significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected WeOS devices to trusted administrators only and avoid processing untrusted media definitions. Monitor vendor communications for updates on official fixes.