Wiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scripting
Multiple W&T Products are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via crafted payloads injected into several input fields of the configuration webpage.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-3020US | — | — | ||
An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Mitigation
Access to the WBM should be limited to trustworthy networks or peers.
- Behoben
All products are EoL. For the following products we strongly recommend upgrading the firmware: Web-IO Digital Logger 6xIn upgrade to 3.84, Web-Count 6x Digital upgrade to 3.84, Web-IO Digital 12xIn/12xOut upgrade to 4.08. For the other products there will be no updates available.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan