CVE-2025-3020
Medium
Description
An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.
SeverityMedium
CVSS5.4
Exploit probability—
ProductERP-Gateway 12x Digital Input, 6x Digital Relais
PublishedMay 6, 2025
First seenMay 6, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Wiesemann & Theis Web-Count 6x Digital3.79 or later
- Wiesemann & Theis Web-IO Digital 12xIn, 12xOut4.08 or later
- Wiesemann & Theis Web-IO Digital Logger 6xIn, 6xOut3.70 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Wiesemann & Theis ERP-Gateway 12x Digital Input, 6x Digital Relais | No range specified | — |
| Wiesemann & Theis ERP-Gateway 2x Digital Input, 2x Digital Output | No range specified | — |
| Wiesemann & Theis ERP-Gateway 2x Digital PoE | No range specified | — |
| Wiesemann & Theis Web-Alarm 6x6 DigitalWeb-Alarm 6x6 Digital | No range specified | — |
| Wiesemann & Theis Web-Count 6x Digital | v < 3.79 | 3.79 |
| Wiesemann & Theis Web-Graph Air Quality | No range specified | — |
| Wiesemann & Theis Web-IO 12x Digital Input, 6x Digital Relais | No range specified | — |
| Wiesemann & Theis Web-IO Analog-In/Out 2x 0/4..20mA PoE | No range specified | — |
| Wiesemann & Theis Web-IO Digital 12xIn, 12xOut | No range specified, v < 4.08 | 4.08 |
| Wiesemann & Theis Web-IO Digital 12xIn, 12xOut, 1xRS232 | No range specified | — |
| Wiesemann & Theis Web-IO Digital 2xIn, 2xOut | No range specified | — |
| Wiesemann & Theis Web-IO Digital Logger 6xIn, 6xOut | v < 3.70 | 3.70 |
| Wiesemann & Theis Web-Thermograph 2x | No range specified | — |
| Wiesemann & Theis Web-Thermograph 8x | No range specified | — |
| Wiesemann & Theis Web-Thermograph NTC | No range specified | — |
| Wiesemann & Theis Web-Thermograph NTC PoE | No range specified | — |
| Wiesemann & Theis Web-Thermograph Pt100 / Pt1000 | No range specified | — |
| Wiesemann & Theis Web-Thermograph Pt100 / Pt1000 PoE | No range specified | — |
| Wiesemann & Theis Web-Thermograph Relais | No range specified | — |
| Wiesemann & Theis Web-Thermo-Hygrobarograph | No range specified | — |
| Wiesemann & Theis Web-Thermo-Hygrograph | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.