CVE-2025-3020: Wiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-06 · updated 2026-06-17
Weakness: CWE-79

Description

An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.

Affected products

Wiesemann & Theis ERP-Gateway 12x Digital Input, 6x Digital Relais: all versions
Wiesemann & Theis ERP-Gateway 2x Digital Input, 2x Digital Output: all versions
Wiesemann & Theis ERP-Gateway 2x Digital PoE: all versions
Wiesemann & Theis Web-Alarm 6x6 DigitalWeb-Alarm 6x6 Digital: all versions
Wiesemann & Theis Web-Count 6x Digital: before 3.79 — fixed in 3.79
Wiesemann & Theis Web-Graph Air Quality: all versions
Wiesemann & Theis Web-IO 12x Digital Input, 6x Digital Relais: all versions
Wiesemann & Theis Web-IO Analog-In/Out 2x 0/4..20mA PoE: all versions
Wiesemann & Theis Web-IO Digital 12xIn, 12xOut: before 4.08 — fixed in 4.08
Wiesemann & Theis Web-IO Digital 12xIn, 12xOut, 1xRS232: all versions
Wiesemann & Theis Web-IO Digital 2xIn, 2xOut: all versions
Wiesemann & Theis Web-IO Digital Logger 6xIn, 6xOut: before 3.70 — fixed in 3.70
Wiesemann & Theis Web-Thermo-Hygrobarograph: all versions
Wiesemann & Theis Web-Thermo-Hygrograph: all versions
Wiesemann & Theis Web-Thermograph 2x: all versions
Wiesemann & Theis Web-Thermograph 8x: all versions
Wiesemann & Theis Web-Thermograph NTC: all versions
Wiesemann & Theis Web-Thermograph NTC PoE: all versions
Wiesemann & Theis Web-Thermograph Pt100 / Pt1000: all versions
Wiesemann & Theis Web-Thermograph Pt100 / Pt1000 PoE: all versions
Wiesemann & Theis Web-Thermograph Relais: all versions

How to fix

Upgrade to a fixed version: Wiesemann & Theis Web-Count 6x Digital 3.79; Wiesemann & Theis Web-IO Digital 12xIn, 12xOut 4.08; Wiesemann & Theis Web-IO Digital Logger 6xIn, 6xOut 3.70. Check the vendor advisory for mitigations.

References

https://cert.vde.com/en/advisories/VDE-2025-032

Get alerted when CVE-2025-3020 or the next vulnerability affects your stack