Description
An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wiesemann & Theis | ERP-Gateway 12x Digital Input, 6x Digital Relais | all | — |
| Wiesemann & Theis | ERP-Gateway 2x Digital Input, 2x Digital Output | all | — |
| Wiesemann & Theis | ERP-Gateway 2x Digital PoE | all | — |
| Wiesemann & Theis | Web-Alarm 6x6 DigitalWeb-Alarm 6x6 Digital | all | — |
| Wiesemann & Theis | Web-Count 6x Digital | < 3.79 | 3.79 |
| Wiesemann & Theis | Web-Graph Air Quality | all | — |
| Wiesemann & Theis | Web-IO 12x Digital Input, 6x Digital Relais | all | — |
| Wiesemann & Theis | Web-IO Analog-In/Out 2x 0/4..20mA PoE | all | — |
| Wiesemann & Theis | Web-IO Digital 12xIn, 12xOut | all, < 4.08 | 4.08 |
| Wiesemann & Theis | Web-IO Digital 12xIn, 12xOut, 1xRS232 | all | — |
| Wiesemann & Theis | Web-IO Digital 2xIn, 2xOut | all | — |
| Wiesemann & Theis | Web-IO Digital Logger 6xIn, 6xOut | < 3.70 | 3.70 |
| Wiesemann & Theis | Web-Thermograph 2x | all | — |
| Wiesemann & Theis | Web-Thermograph 8x | all | — |
| Wiesemann & Theis | Web-Thermograph NTC | all | — |
| Wiesemann & Theis | Web-Thermograph NTC PoE | all | — |
| Wiesemann & Theis | Web-Thermograph Pt100 / Pt1000 | all | — |
| Wiesemann & Theis | Web-Thermograph Pt100 / Pt1000 PoE | all | — |
| Wiesemann & Theis | Web-Thermograph Relais | all | — |
| Wiesemann & Theis | Web-Thermo-Hygrobarograph | all | — |
| Wiesemann & Theis | Web-Thermo-Hygrograph | all | — |
Advisories 1
- VDE-2025-032 Wiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scripting CERT@VDE · May 6, 2025