Skip to content
OpenAdvisories
High VDE-2025-067 1 CVE

Wiesemann & Theis: Motherbox 3 allows unauthenticated read-only DB access

Published Aug 10, 2025 · Updated Jul 3, 2026 · Revision 3

Vendor: Wiesemann & Theis Product: Motherbox 3

Summary

Motherbox 3 with firmware 1.44 to 1.48 allows an unauthenticated remote attacker read-only access to the internal DB with measurement values from other W&T sensor devices.

Details

Impact
When logging into the internal database of the Motherbox 3 the user can get access without password protection. This enables the unprotected read-only access to the stored measurement data.

Remediation
Update the Motherbox 3 firmware to version 1.49.

Vulnerabilities 1

  • High 7.5
    CVE-2025-41689

    Wiesemann & Theis: Motherbox 3 allows unauthenticated read-only DB access

    An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only access to the stored measurement data.

    Wiesemann & Theis Motherbox 3

Revision history

  1. #1.1.1

    Fixed Vendor Variable in Product tree

  2. #1.1.0

    Changed CVE Score from C:L to C:H and changed in the CVE Description the word "grants" to "get"

  3. #1.0.0

    Initial revision

References