Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.

An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system logging information (syslog verbose logging that includes credentials).

Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.