Summary
Com-Server firmware versions prior to 1.60 support the insecure TLS 1.0 and TLS 1.1 protocols, which are susceptible to man-in-the-middle attacks and thereby compromise the confidentiality and integrity of data.
Details
Impact
An attacker with network access could exploit the use of insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems. This could lead to unauthorized data access, credential theft, compromising the confidentiality and integrity of transmitted information.
Remediation
Update the Com-Server firmware to version 1.60.
Vulnerabilities 1
-
Critical 9.1
Com-Server Exposed via Weak TLS
An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems.
Revision history
-
#1
Initial revision
References
-
VDE-2025-031: Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated TLS protocol versions - HTML
https://certvde.com/en/advisories/VDE-2025-031/
-
Wiesemann & Theis advisory overview at CERT@VDE
https://certvde.com/en/advisories/vendor/wut/
-
IT- and Product Security at W&T
https://www.wut.de/e-wwwww-si-inus-000.php