Wiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scripting
Multiple W&T Products are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via crafted payloads injected into several input fields of the configuration webpage.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-3020US | — | — | ||
An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact. | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
Access to the WBM should be limited to trustworthy networks or peers.
- Fixed
All products are EoL. For the following products we strongly recommend upgrading the firmware: Web-IO Digital Logger 6xIn upgrade to 3.84, Web-Count 6x Digital upgrade to 3.84, Web-IO Digital 12xIn/12xOut upgrade to 4.08. For the other products there will be no updates available.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan