CVE-2023-45735 is a high severity code injection flaw in the Westermo Lynx L206-F2G switch, firmware 4.24, scored 8.0. Someone with access to the device may run malicious code. The CISA advisory lists no fixed version, so restrict access and harden the device.
What's affected
CISA's ICS advisory, ICSA-24-023-04, lists the Lynx 206-F2G model L206-F2G1 with firmware 4.24 as affected. The NVD record matches that firmware version. The advisory lists no fixed version. It says Westermo will address it in a future report, so there is no patched release to name here.
The CVSS 3.1 score is 8.0, High, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The record and the advisory agree. The attack is network reachable, needs a low privileged account and a user action, and has high impact.
How to check if you're exposed
Open the device's web interface or console and read the firmware version on the status page. Any unit of the L206-F2G1 model running 4.24 is in scope.
Then work out who can reach the management interface. For industrial switches that is usually a question for the network team, not the device. Check firewall rules, VLAN membership and any remote access path to the control network.
What to do now
- Identify L206-F2G1 devices and confirm they run firmware 4.24.
- Check Westermo's security pages for a patched firmware release, since the CISA advisory lists none.
- Follow Westermo's general advice: restrict access and disable services you do not use.
- Follow CISA's guidance: minimize network exposure, keep control networks behind firewalls and apart from business networks, and use VPNs for remote access.
- Review accounts on the device and remove any that are not needed, since the flaw needs a login.
Why it matters
The weakness is code injection, CWE-94. The description in the record is brief: an attacker with access to the device may be able to execute malicious code that affects its correct functioning. The advisory does not give further detail, and I will not add any.
Switches in industrial networks do not get patched on the same rhythm as servers, and some run unchanged for years. With no fixed firmware listed, the controls that remain are network placement, account hygiene and monitoring.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not report exploitation.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Is there a patch?
The CISA advisory lists no fixed version. Check Westermo directly for updates.
What can I do in the meantime?
Restrict access to the device, disable unused services, and keep it on a segmented network, as Westermo and CISA advise.
Sources
Last reviewed: 19 October 2026.
