Most recent entries from csaf_wiesemanntheisgmbh

VDE-2025-067 — Wiesemann & Theis: Motherbox 3 allows unauthenticated read-only DB access

Sun, 10 Aug 2025 10:00:00 +0000

Motherbox 3 with firmware 1.44 to 1.48 allows an unauthenticated remote attacker read-only access to the internal DB with measurement values from other W&T sensor devices.

VDE-2025-024 — Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated jQuery version

Tue, 13 May 2025 10:00:00 +0000

Multiple W&T devices are shipped with a jQuery version with a known XSS vulnerability.

VDE-2025-032 — Wiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scripting

Tue, 06 May 2025 10:00:00 +0000

Multiple W&T Products are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via crafted payloads injected into several input fields of the configuration webpage.

VDE-2025-031 — Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated TLS protocol versions

Mon, 28 Apr 2025 10:00:00 +0000

Com-Server firmware versions prior to 1.60 support the insecure TLS 1.0 and TLS 1.1 protocols, which are susceptible to man-in-the-middle attacks and thereby compromise the confidentiality and integrity of data.

VDE-2024-018 — Wiesemann & Theis: Multiple products prone to unquoted search path

Wed, 28 Feb 2024 07:00:00 +0000

Multiple Wiesemann & Theis software products are affected by a vulnerability through an unquoted search path in the Windows registry. A local attacker can execute arbitrary code and gain administrative privileges by inserting an executable file in the path of the affected product.

Update A, 07.03.2024

Incorrect version numbers have been corrected.

VDE-2022-057 — Wiesemann & Theis multiple products prone to web interface vulnerability

Tue, 13 Dec 2022 07:00:00 +0000

Multiple Wiesemann & Theis product families are affected by a vulnerability in the web interface. The device allows an unauthenticated attacker to get the session ID of a logged in user. He may then spoof his IP address to act as the logged in user.

VDE-2022-043 — Wiesemann & Theis: Multiple Vulnerabilities in the Com-Server Family

Mon, 07 Nov 2022 11:43:00 +0000

Multiple Wiesemann & Theis product families are affected by multiple vulnerabilities in the web interface.