| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| 58665 | Com-Server++ | < 1.60 |
| 58664 | Com-Server 20mA | < 1.60 |
| 58461 | Com-Server OEM | < 1.60 |
| 58662 | Com-Server PoE 3x Isolated | < 1.60 |
| 58669 | Com-Server UL | < 1.60 |
Com-Server firmware versions prior to 1.60 support the insecure TLS 1.0 and TLS 1.1 protocols, which are susceptible to man-in-the-middle attacks and thereby compromise the confidentiality and integrity of data.
An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems.
An attacker with network access could exploit the use of insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems. This could lead to unauthorized data access, credential theft, compromising the confidentiality and integrity of transmitted information.
Remediation
Update the Com-Server firmware to version 1.60.
CERT@VDE coordinated with Wiesemann & Theis GmbH