Share: Email | Twitter

ID

VDE-2025-024

Published

2025-05-13 10:00 (CEST)

Last update

2025-05-12 12:06 (CEST)

Vendor(s)

Wiesemann & Theis GmbH

Product(s)

Article No° Product Name Affected Version(s)
FTP Data Station 3 < 1.29
Motherbox 3 < 1.48
pure.box 3 < 1.83
pure.box 3 Serial < 1.83
pure.box 3 Serial / USB < 1.83
pure.box 3 USB < 1.83
USB-Server Industry Isochron < 2.21

Summary

Multiple W&T devices are shipped with a jQuery version with a known XSS vulnerability.

CVE ID

CVE-2012-6708 

Last Update:

Sept. 8, 2021, 9:28 a.m.

Severity

6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) 

Weakness

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')  (CWE-79) 

Summary

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Details

nvd.nist.gov 

Impact

Multiple W&T Products are prone to an XSS attack. An autenticated remote attacker can execute arbitrary web scripts or HTML via crafted payload injected into fields on the configuration webpage.

Solution

Remediation

Update the affected devices to the following firmware:

  • USB-Server Industry Isochron to 2.21
  • FTP Data Station 3 to 1.29
  • Motherbox 3 to 1.48
  • pure.box 3, pure.box 3 USB, pure.box 3 Serial, pure.box 3 Serial / USB to 1.83

Reported by

CERT@VDE coordinated with Wiesemann & Theis