W&T PSIRT (CSAF)
advisoryDEwut_psirt
W&T (Wiesemann & Theis) PSIRT CSAF 2.0 advisories (hosted by CERT@VDE).
01
advisories (7)
Vendor and ecosystem advisories describing this.
02
product assertions (73)
Products and version ranges known to be affected.
- Firmware 1.29 installed on FTP Data Station 3
- Firmware 1.44<=1.48 installed on Motherbox 3
- Firmware 1.48 installed on Motherbox 3
- Firmware 1.49 installed on Motherbox 3
- Firmware 1.60 installed on Com-Server 20mA
- Firmware 1.60 installed on Com-Server OEM
- Firmware 1.60 installed on Com-Server PoE 3x Isolated
- Firmware 1.60 installed on Com-Server UL
- Firmware 1.60 installed on Com-Server++
- Firmware 1.83 installed on pure.box 3
- Firmware 1.83 installed on pure.box 3 Serial
- Firmware 1.83 installed on pure.box 3 Serial / USB
- Firmware 1.83 installed on pure.box 3 USB
- Firmware 2.21 installed on USB-Server Industry Isochron
- Firmware 3.84 installed on Web-Count 6x Digital
- Firmware 3.84 installed on Web-IO Digital Logger 6xIn, 6xOut
- Firmware 4.08 installed on Web-IO Digital 12xIn, 12xOut
- Firmware <1.29 installed on FTP Data Station 3
- Firmware <1.48 installed on Motherbox 3
- Firmware <1.60 installed on Com-Server 20mA
showing 20 of 73
03
CVE links (9)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41689US | —OT elevated | — | ||
An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only access to the stored measurement data. | ||||
| CVE-2025-3020US | — | — | ||
An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact. | ||||
| CVE-2025-3200US | —OT elevated | — | ||
An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and co… | ||||
| CVE-2024-25552US | — | — | ||
A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product. | ||||
| CVE-2022-4098US | — | — | ||
Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthen… | ||||
| CVE-2022-42785US | —OT elevated | — | ||
Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a m… | ||||
| CVE-2022-42787US | —OT elevated | — | ||
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the use… | ||||
| CVE-2022-42786US | — | — | ||
Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected… | ||||
| CVE-2012-6708US | medium6.1 | Exploit | ||
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerab… | ||||