VDE-2025-024 — Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated jQuery version

Summary

Multiple W&T devices are shipped with a jQuery version with a known XSS vulnerability.

Details

Impact
Multiple W&T Products are prone to an XSS attack. An autenticated remote attacker can execute arbitrary web scripts or HTML via crafted payload injected into fields on the configuration webpage.

Remediation
Update the affected devices to the firmware listed below.

Vulnerabilities 1

Medium 6.1

CVE-2012-6708 Public exploit

Cross-Site Scripting in jquery

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…

ruby ceph jquery-rails org.webjars.npm:jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems

Jan 18, 2018

Revision history

2025-05-13 #1
Initial revision

References

VDE-2025-024: Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated jQuery version - HTML
https://certvde.com/en/advisories/VDE-2025-024/
CERT@VDE Security Advisories for Wiesemann & Theis
https://certvde.com/de/advisories/vendor/wut/