CVE-2023-38579 is a high severity (CVSS 8.0) cross-site request forgery flaw in the Westermo Lynx 206-F2G switch, firmware 4.24, where the CSRF token may be predictable. CISA's advisory says a later WeOS4 version patched it but does not give the number, so ask Westermo.
What's affected
The affected product is the Westermo Lynx 206-F2G, a layer three industrial Ethernet switch, model L206-F2G1, firmware version 4.24. The weakness is that the cross-site request forgery token may be predictable or easily guessable, so an attacker can craft a malicious request that a victim triggers unknowingly. The record is dated 2024-02-06 and scores 8.0, High, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. CISA's advisory ICSA-24-023-04, published 23 January 2024, gives the same 8.0.
CISA's advisory covers eight issues in the same firmware. For this one, it says the CSRF vulnerability was patched in a later WeOS4 version, but it does not name the version. For the others it says the cross-site scripting, code injection and CORS issues will be mitigated in a future release. The advisory says no known public exploitation has been reported to CISA. Ask Westermo for the fixed WeOS4 release for your switch.
Weakness class: CWE-352.
How to check if you're exposed
Open the switch's web interface, or connect over SSH, and read the firmware version. The version 4.24 is named in the record.
Then check which networks and which administrator workstations can reach the switch's web interface. This flaw needs a victim with an active session to be tricked, so the browser used for administration matters as much as the device.
What to do now
- Find Westermo Lynx switches and record the WeOS version on each.
- Ask Westermo for the fixed WeOS4 version and upgrade.
- Restrict the web interface to a management network and a few administrator workstations.
- Do not browse the web or read email in the browser session used to manage the switch.
- Follow the CISA recommendations: keep control system devices off the Internet and behind firewalls.
Why it matters
Cross-site request forgery tricks a logged-in administrator's browser into sending a request the administrator never intended. The standard defence is an unpredictable token that the server checks. If the token can be guessed, the check is empty, and a malicious page can submit a valid looking request.
For industrial switches the impact of a forged request can be high, since a configuration change can alter traffic across a plant. That is why the vector shows high impact on confidentiality, integrity and availability. CISA's advice to isolate control system devices remains the strongest control. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Cross-site request forgery tricks a logged-in user's browser into sending a request the user did not intend. Defences are unpredictable per-session anti-forgery tokens that the server validates, plus same-site cookie settings. A token that is predictable or guessable defeats the defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
Which firmware fixes it?
CISA says a later WeOS4 version, without naming it. Ask Westermo for the exact release.
Does a user have to click anything?
Yes. The vector requires user interaction, such as an administrator visiting a malicious page while logged in.
Sources
Last reviewed: 19 October 2026.
