Skip to content
OpenAdvisories
Medium VDE-2025-032 1 CVE

Wiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scripting

Published May 6, 2025 · Updated May 6, 2025

Vendor: VENDOR_NAME Product: ERP-Gateway 12x Digital Input, 6x Digital Relais Product: ERP-Gateway 2x Digital Input, 2x Digital Output Product: ERP-Gateway 2x Digital PoE Product: Web-Alarm 6x6 DigitalWeb-Alarm 6x6 Digital Product: Web-Count 6x Digital Product: Web-Graph Air Quality Product: Web-IO 12x Digital Input, 6x Digital Relais Product: Web-IO Analog-In/Out 0/4..20mA PoE Product: Web-IO Analog-In/Out 2x 0..10V PoE Product: Web-IO Digital 12xIn, 12xOut Product: Web-IO Digital 12xIn, 12xOut, 1xRS232 Product: Web-IO Digital 2xIn, 2xOut Product: Web-IO Digital Logger 6xIn, 6xOut Product: Web-Thermo-Hygrobarograph Product: Web-Thermo-Hygrograph Product: Web-Thermograph 2x Product: Web-Thermograph 8x Product: Web-Thermograph NTC Product: Web-Thermograph NTC PoE Product: Web-Thermograph Pt100 Product: Web-Thermograph Pt100 / Pt1000 PoE Product: Web-Thermograph Relais

Summary

Multiple W&T Products are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via crafted payloads injected into several input fields of the configuration webpage.

Details

Remediation
All products are EoL.
For the following products we strongly recommend upgrading the firmware:
* Web-IO Digital Logger 6xIn upgrade to 3.84
* Web-Count 6x Digital upgrade to 3.84
* Web-IO Digital 12xIn/12xOut upgrade to 4.08

For the other products there will be no updates available.

Impact
Multiple W&T Products are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage.

Vulnerabilities 1

Revision history

  1. #1

    Initial revision

References