CVE-2015-7923: Westermo WeOS Industrial Switch Shared SSL Private Key

CVE-2015-7923 is a cryptographic-issue vulnerability (CWE-310) in Westermo's WeOS firmware: every device running a version before 4.19.0 ships with the exact same hard-coded SSL private key, so an attacker who extracts that key from any single unit can impersonate the HTTPS management interface of any other WeOS switch or router and intercept or tamper with traffic in a man-in-the-middle position; NVD's own Primary analysis scores it 9.0 (critical) on the CVSS v3.0 scale.

CVE-2015-7923 (CWE-310, cryptographic issues) affects Westermo's WeOS firmware. NVD's description states: "Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key" (NVD).

WeOS is the switch/router operating system Westermo ships across its managed industrial Ethernet product families; CISA's ICS advisory ICSA-16-028-01 ("Westermo Industrial Switch Hard-coded Certificate Vulnerability," Update A) lists the affected lines as the Falcon, Lynx, Wolverine, Corazon, Viper and Redfox switch and router series running WeOS before 4.19.0, and explains that because "the SSL keys used by the switches to provide secure communications are hard coded," an attacker who obtains the key from one device can pose as any other WeOS unit and, after a successful man-in-the-middle position, capture credentials entered by the end user (CISA ICS Advisory ICSA-16-028-01).

NVD's own Primary analysis assigns a CVSS v3.0 base score of 9.0 (critical), vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, no privileges or user interaction required, though attack complexity is rated high because exploitation needs a prior man-in-the-middle position. NVD also carries an older CVSS v2 Primary score of 9.3 for the same CVE; this page reports the modern v3.0 figure (NVD). CISA's own advisory separately computed a CVSS v3 base score of 9.0 with an 8.2 temporal score, consistent with NVD's rating.

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01206 (68.492nd percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

Operators of affected WeOS switches and routers should upgrade to at least firmware 4.15.2 to gain the ability to replace the shared default certificate, upload a new certificate issued by their own internal or external PKI rather than a self-signed one, and restrict the web management interface to trusted networks in the meantime — ideally upgrading all the way to 4.19.0 or later, which removes the shared key design entirely.

• Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, making it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key. — NVD
• CISA ICSA-16-028-01 (Update A), "Westermo Industrial Switch Hard-coded Certificate Vulnerability": affects the Falcon, Lynx, Wolverine, Corazon, Viper and Redfox WeOS switch/router series; the hard-coded SSL key lets an attacker impersonate a device after a man-in-the-middle position and capture user credentials. — CISA ICS Advisory ICSA-16-028-01
• NVD Primary CVSS v3.0 base score is 9.0 (critical), vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; an older CVSS v2 Primary score of 9.3 is also recorded for the same CVE; CISA's own advisory separately scored it 9.0 base / 8.2 temporal. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01206 (68.492nd percentile) as of 2026-11-07. — FIRST EPSS