Version
2.20.1
Support status
Not supported
SBOMs
4/4
VDR documents
4
VEX & VDR documents
4
WebIQ Components & Security Artifacts
Updated automatically
| Component | Version | SBOM | VDR | VEX | Artifacts |
|---|---|---|---|---|---|
WebIQ Server CONNECT |
2.20.1 |
CycloneDX 1.5 · 13 components
|
13 known vulnerability/vulnerabilities · 2026-10-15 07:16
|
13 assessment(s) · 2026-10-15 07:16
|
SBOM VDR VEX |
WebIQ Designer DESIGNER |
2.20.1 |
CycloneDX 1.5 · 199 components
|
6 known vulnerability/vulnerabilities · 2026-10-15 07:16
|
6 assessment(s) · 2026-10-15 07:16
|
SBOM VDR VEX |
IOHandler ModBus MODBUS |
1.0.0 |
CycloneDX 1.5 · 3 components
|
13 known vulnerability/vulnerabilities · 2026-10-15 07:16
|
13 assessment(s) · 2026-10-15 07:16
|
SBOM VDR VEX |
IOHandler OPC-UA OPCUA |
2.5.0 |
CycloneDX 1.5 · 5 components
|
22 known vulnerability/vulnerabilities · 2026-10-15 07:16
|
22 assessment(s) · 2026-10-15 07:16
|
SBOM VDR VEX |
Changelog
WebIQ 2.20.1 Changelog
Main Features & Release Notes
Mainly fixing a WebIQ Server crash found in 2.20.0 shortly before release. Includes some other small bugfixes.
WebIQ Designer
- WEBIQ-5594 Fix: Localization Manager: the "show locale" popup was not correctly positioned over the configuration button
WebIQ Visuals
- WEBIQ-5601 Fix: MD Trend Zoom: vertical layout did not work, was shown as horizontal
- WEBIQ-5595 Fix: IQ/MD widgets: several widgets allowed customization of a label even when the widget did not have a label
WebIQ Server
- WEBIQ-5581 Runtime Manager: removed superfluous "disable MFA" option in "Create new user" dialog
- WEBIQ-5623 Fix: Runtime Manager: session termination did no longer work in 2.19.0
- WEBIQ-5604 Fix: Fixed a crash in 2.20.0 when the connection is closed but some data is still in the send queue
WebIQ General
- WEBIQ-5593 Prevent running the installer while WebIQ Designer is still running
Release Notes
A WebIQ Server crash was found shortly before the official release of 2.20.0, therefore it was not released and 2.20.1 is now the version including that fix.
This release is adding more cybersecurity features leaving just a few gaps for CRA compliance. See below for all details. This release also introduces ModBus TCP and ModBus TLS (not ModBus RTU).
NOTE: HTTPS by default: When installing WebIQ 2.20.0 (instead of updating an existing version) WebIQ will use HTTPS on port 10123 instead of HTTP to meet CRA requirements.
NOTE: ModBus: For using ModBus you have to manually specify either "ioHandlerModbusTCP" or "ioHandlerModbusTLS" as "Shared Library" in IO Manager to use it. Be aware of the EU CRA regulations when using the non-encrypted TCP version.
WARNING: LINUX: This is the last release with support for Linux distributions released prior to 2021 as we will be updating https://en.wikipedia.org/wiki/Glibc[glibc] to version 2.31 with the next release.
Known Issues
This section contains known functional or technical product issues. Security vulnerabilities are shown separately under “Known vulnerabilities”.
no known issues to date
Known Vulnerabilities
VDR + VEXThis sections lists all evaluated, confirmed and non-confirmed vulnerabilities found in WebIQ or its components. For supported versions the vulnerabilities are evaluated in a timely manner by our development team. In case of exploitable vulnerabilities in supported versions new versions will be made available.
Summary by Component
| WebIQ Component | Total | Highest severity | Distribution |
|---|---|---|---|
| CONNECTWebIQ Server | 13 | HIGH8.2 | 4 HIGH · 5 MEDIUM · 4 LOW |
| DESIGNERWebIQ Designer | 6 | CRITICAL9.1 | 1 CRITICAL · 2 HIGH · 1 MEDIUM · 2 LOW |
| MODBUSIOHandler ModBus | 4 | MEDIUM5.3 | 1 MEDIUM · 3 LOW |
| OPCUAIOHandler OPC-UA | 22 | HIGH8.2 | 11 HIGH · 6 MEDIUM · 5 LOW |
1. Present in components, but not actively exploitable in the WebIQ context9
This section lists known vulnerabilities in components used by WebIQ that we have validated are not exploitable in WebIQ.
| Identifier | External Dependency | WebIQ Component | Assessment | Severity | Note |
|---|---|---|---|---|---|
| CVE-2026-84782 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | HIGH8.2 | DTLS not used by WebIQ |
| CVE-2026-54873 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | HIGH7.5 | QUIC not used by WebIQ |
| CVE-2026-72897 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | HIGH7.5 | WebIQ does not do what is required to trigger the issue. Neither it nor its TLS reliant dependencies (Boost.Asio, Unified Automation UaSDK) call SSL_set_SSL_CTX part way through a handshake. |
| CVE-2026-84784 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | HIGH7.5 | QUIC not used by WebIQ |
| CVE-2026-42772 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | MEDIUM5.3 | QUIC not used by WebIQ |
| CVE-2026-75804 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | MEDIUM5.3 | QUIC not used by WebIQ |
| CVE-2026-75805 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | MEDIUM5.3 | CMP not used by WebIQ |
| CVE-2026-75806 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | MEDIUM5.3 | DTLS not used by WebIQ |
| CVE-2026-35191 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | LOW3.7 | QUIC not used by WebIQ |
2. Exploitable, but no active exploitation in WebIQ known or reported4
These components are technically exploitable in WebIQ context, but no active exploitation is known or reported.
| Identifier | External Dependency | WebIQ Component | Assessment | Severity | Source | Note |
|---|---|---|---|---|---|---|
| CVE-2026-35189 | openssl 3.5.8 |
IOHandler ModBus
|
Exploitable; no active WebIQ exploitation known | MEDIUM5.3 | VEX | The vulnerability is technically relevant; active exploitation against WebIQ is not known or reported. |
| CVE-2026-54872 | openssl 3.5.8 |
IOHandler ModBus
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-54875 | openssl 3.5.8 |
IOHandler ModBus
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-77696 | openssl 3.5.8 |
IOHandler ModBus
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
3. Actively exploited in WebIQ0
This category lists known exploitations of vulnerabilities in WebIQ. These will also be reported to ENISA.
No active exploitation in WebIQ is currently known or reported.
4. Unevaluated Vulnerabilities41
This section contains potential vulnerabilities that have not been fully evaluated by Smart-HMI. This usually only happens for supported releases.
This WebIQ version is no longer supported. Unevaluated vulnerabilities should therefore be treated as exploitable as a precaution. Upgrade to the latest supported version 2.21.0.
| Identifier | External Dependency | WebIQ Component | Assessment | Severity |
|---|---|---|---|---|
| GHSA-jqcg-44mw-7w3h | proxy-addr 2.0.7 |
WebIQ Designer
|
Not assessed by Smart-HMI | CRITICAL9.1 |
| CVE-2026-84782 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | HIGH8.2 |
| CVE-2026-84782 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH8.2 |
| CVE-2026-11979 | libxml2 2.15.3 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.8 |
| CVE-2026-86138 | libxml2 2.15.3 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.8 |
| CVE-2026-86139 | libxml2 2.15.3 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.8 |
| CVE-2026-86140 | libxml2 2.15.3 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.8 |
| CVE-2026-86142 | libxml2 2.15.3 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.8 |
| CVE-2026-86144 | libxml2 2.15.3 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.8 |
| CVE-2026-54873 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | HIGH7.5 |
| CVE-2026-54873 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.5 |
| CVE-2026-72897 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | HIGH7.5 |
| CVE-2026-72897 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.5 |
| CVE-2026-84784 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | HIGH7.5 |
| CVE-2026-84784 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.5 |
| GHSA-6j4f-fj2g-mc7p | brace-expansion 5.0.9 |
WebIQ Designer
|
Not assessed by Smart-HMI | HIGH7.5 |
| GHSA-qhr7-859c-m2p7 | brace-expansion 5.0.9 |
WebIQ Designer
|
Not assessed by Smart-HMI | HIGH7.5 |
| CVE-2026-86143 | libxml2 2.15.3 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | HIGH7.3 |
| CVE-2026-86137 | libxml2 2.15.3 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | MEDIUM6.1 |
| CVE-2026-35189 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-35189 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-42772 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-42772 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-75804 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-75804 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-75805 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-75805 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-75806 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-75806 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| GHSA-q2hr-2g5m-vwhr | brace-expansion 5.0.9 |
WebIQ Designer
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| CVE-2026-35191 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | LOW3.7 |
| CVE-2026-35191 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | LOW3.7 |
| CVE-2026-54872 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | LOW3.7 |
| CVE-2026-54872 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | LOW3.7 |
| CVE-2026-54875 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | LOW3.7 |
| CVE-2026-54875 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | LOW3.7 |
| CVE-2026-77696 | openssl 3.5.8 |
WebIQ Server
|
Not assessed by Smart-HMI | LOW3.7 |
| CVE-2026-77696 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | LOW3.7 |
| CVE-2026-86141 | libxml2 2.15.3 |
IOHandler OPC-UA
|
Not assessed by Smart-HMI | LOW3.3 |
| GHSA-p98j-92pf-mc4p | dompurify 3.4.15 |
WebIQ Designer
|
Not assessed by Smart-HMI | LOW2.3 |
| GHSA-6688-9rhm-gjv2 | dompurify 3.4.15 |
WebIQ Designer
|
Not assessed by Smart-HMI | LOW |