{"document":{"acknowledgments":[{"organization":"CERTVDE","summary":"Coordination","urls":["https://certvde.com/en/"]}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"Multiple W&T devices are shipped with a jQuery version with a known XSS vulnerability.","title":"Summary"},{"category":"description","text":"Multiple W&T Products are prone to an XSS attack. An autenticated remote attacker can execute arbitrary web scripts or HTML via crafted payload injected into fields on the configuration webpage.","title":"Impact"},{"category":"description","text":"Update the affected devices to the firmware listed below.","title":"Remediation"}],"publisher":{"category":"vendor","contact_details":"security@wut.de","name":"Wiesemann & Theis GmbH","namespace":"https://www.wut.de"},"references":[{"category":"self","summary":"VDE-2025-024: Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated jQuery version - HTML","url":"https://certvde.com/en/advisories/VDE-2025-024/"},{"category":"self","summary":"VDE-2025-024: Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated jQuery version - CSAF","url":"https://wut.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-024.json"},{"category":"external","summary":"CERT@VDE Security Advisories for Wiesemann & Theis","url":"https://certvde.com/de/advisories/vendor/wut/"}],"title":"Wiesemann & Theis: Multiple products from Wiesemann & Theis support deprecated jQuery version","tracking":{"aliases":["VDE-2025-024"],"current_release_date":"2025-05-13T10:00:00.000Z","generator":{"date":"2025-05-05T06:00:55.299Z","engine":{"name":"Secvisogram","version":"2.5.24"}},"id":"VDE-2025-024","initial_release_date":"2025-05-13T10:00:00.000Z","revision_history":[{"date":"2025-05-13T10:00:00.000Z","number":"1","summary":"Initial revision"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"USB-Server Industry Isochron","product":{"name":"USB-Server Industry Isochron","product_id":"CSAFPID-11001","product_identification_helper":{"model_numbers":["53642"]}}},{"category":"product_name","name":"FTP Data Station 3","product":{"name":"FTP Data Station 3","product_id":"CSAFPID-11002","product_identification_helper":{"model_numbers":["50543"]}}},{"category":"product_name","name":"Motherbox 3","product":{"name":"Motherbox 3","product_id":"CSAFPID-11003","product_identification_helper":{"model_numbers":["50504"]}}},{"category":"product_name","name":"pure.box 3","product":{"name":"pure.box 3","product_id":"CSAFPID-11004","product_identification_helper":{"model_numbers":["50518"]}}},{"category":"product_name","name":"pure.box 3 USB","product":{"name":"pure.box 3 USB","product_id":"CSAFPID-11005","product_identification_helper":{"model_numbers":["50519"]}}},{"category":"product_name","name":"pure.box 3 Serial","product":{"name":"pure.box 3 Serial","product_id":"CSAFPID-11006","product_identification_helper":{"model_numbers":["50520"]}}},{"category":"product_name","name":"pure.box 3 Serial / USB","product":{"name":"pure.box 3 Serial / USB","product_id":"CSAFPID-11007","product_identification_helper":{"model_numbers":["50521"]}}}],"category":"product_family","name":"Hardware"},{"branches":[{"category":"product_version_range","name":"<2.21","product":{"name":"Firmware <2.21","product_id":"CSAFPID-21001"}},{"category":"product_version","name":"2.21","product":{"name":"Firmware 2.21","product_id":"CSAFPID-22001"}},{"category":"product_version_range","name":"<1.29","product":{"name":"Firmware <1.29","product_id":"CSAFPID-21002"}},{"category":"product_version","name":"1.29","product":{"name":"Firmware 1.29","product_id":"CSAFPID-22002"}},{"category":"product_version_range","name":"<1.48","product":{"name":"Firmware <1.48","product_id":"CSAFPID-21003"}},{"category":"product_version","name":"1.48","product":{"name":"Firmware 1.48","product_id":"CSAFPID-22003"}},{"category":"product_version_range","name":"<1.83","product":{"name":"Firmware <1.83","product_id":"CSAFPID-21004"}},{"category":"product_version","name":"1.83","product":{"name":"Firmware 1.83","product_id":"CSAFPID-22004"}}],"category":"product_family","name":"Firmware"}],"category":"vendor","name":"VENDOR_NAME"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007"],"summary":"Affected products."},{"group_id":"CSAFGID-0002","product_ids":["CSAFPID-32001","CSAFPID-32002","CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007"],"summary":"Fixed Products."}],"relationships":[{"category":"installed_on","full_product_name":{"name":"Firmware <2.21 installed on USB-Server Industry Isochron","product_id":"CSAFPID-31001"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware <1.29 installed on FTP Data Station 3","product_id":"CSAFPID-31002"},"product_reference":"CSAFPID-21002","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware <1.48 installed on Motherbox 3","product_id":"CSAFPID-31003"},"product_reference":"CSAFPID-21003","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware <1.83 installed on pure.box 3","product_id":"CSAFPID-31004"},"product_reference":"CSAFPID-21004","relates_to_product_reference":"CSAFPID-11004"},{"category":"installed_on","full_product_name":{"name":"Firmware <1.83 installed on pure.box 3 USB","product_id":"CSAFPID-31005"},"product_reference":"CSAFPID-21004","relates_to_product_reference":"CSAFPID-11005"},{"category":"installed_on","full_product_name":{"name":"Firmware <1.83 installed on pure.box 3 Serial","product_id":"CSAFPID-31006"},"product_reference":"CSAFPID-21004","relates_to_product_reference":"CSAFPID-11006"},{"category":"installed_on","full_product_name":{"name":"Firmware <1.83 installed on pure.box 3 Serial / USB","product_id":"CSAFPID-31007"},"product_reference":"CSAFPID-21004","relates_to_product_reference":"CSAFPID-11007"},{"category":"installed_on","full_product_name":{"name":"Firmware 2.21 installed on USB-Server Industry Isochron","product_id":"CSAFPID-32001"},"product_reference":"CSAFPID-22001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.29 installed on FTP Data Station 3","product_id":"CSAFPID-32002"},"product_reference":"CSAFPID-22002","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.48 installed on Motherbox 3","product_id":"CSAFPID-32003"},"product_reference":"CSAFPID-22003","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.83 installed on pure.box 3","product_id":"CSAFPID-32004"},"product_reference":"CSAFPID-22004","relates_to_product_reference":"CSAFPID-11004"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.83 installed on pure.box 3 USB","product_id":"CSAFPID-32005"},"product_reference":"CSAFPID-22004","relates_to_product_reference":"CSAFPID-11005"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.83 installed on pure.box 3 Serial","product_id":"CSAFPID-32006"},"product_reference":"CSAFPID-22004","relates_to_product_reference":"CSAFPID-11006"},{"category":"installed_on","full_product_name":{"name":"Firmware 1.83 installed on pure.box 3 Serial / USB","product_id":"CSAFPID-32007"},"product_reference":"CSAFPID-22004","relates_to_product_reference":"CSAFPID-11007"}]},"vulnerabilities":[{"cve":"CVE-2012-6708","cwe":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"},"notes":[{"audience":"all","category":"description","text":"jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.","title":"Vulnerability Description"}],"product_status":{"fixed":["CSAFPID-32001","CSAFPID-32002","CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007"]},"remediations":[{"category":"mitigation","details":"Access to the WBM should be limited to trustworthy networks or peers. ","group_ids":["CSAFGID-0001"]},{"category":"vendor_fix","details":"Update the affected devices to the versions listed below.\n","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","environmentalScore":6.1,"environmentalSeverity":"MEDIUM","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","temporalScore":6.1,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007"]}],"title":"CVE-2012-6708"}]}