Version
2.20.2
Support status
Not supported
SBOMs
4/4
VDR documents
4
VEX & VDR documents
4
WebIQ Components & Security Artifacts
Updated automatically
| Component | Version | SBOM | VDR | VEX | Artifacts |
|---|---|---|---|---|---|
WebIQ Server CONNECT |
2.20.2 |
CycloneDX 1.5 · 13 components
|
13 known vulnerability/vulnerabilities · 2026-10-15 07:16
|
13 assessment(s) · 2026-10-15 07:16
|
SBOM VDR VEX |
WebIQ Designer DESIGNER |
2.20.2 |
CycloneDX 1.5 · 199 components
|
6 known vulnerability/vulnerabilities · 2026-10-15 07:16
|
6 assessment(s) · 2026-10-15 07:16
|
SBOM VDR VEX |
IOHandler ModBus MODBUS |
1.0.0 |
CycloneDX 1.5 · 3 components
|
13 known vulnerability/vulnerabilities · 2026-10-15 07:16
|
13 assessment(s) · 2026-10-15 07:16
|
SBOM VDR VEX |
IOHandler OPC-UA OPCUA |
2.5.1 |
CycloneDX 1.5 · 5 components
|
13 known vulnerability/vulnerabilities · 2026-10-15 07:16
|
13 assessment(s) · 2026-10-15 07:16
|
SBOM VDR VEX |
Changelog
WebIQ 2.20.2 Changelog
Main Features & Release Notes
WebIQ Designer
- WEBIQ-5628 Fix: Launcher: in certain constellations the launcher settings were reset which might have caused inability to connect to an HTTP WebIQ Server which was considered as HTTPS
- WEBIQ-5620 Fix: Localization was missing for the project import dialog placeholders
- WEBIQ-5597 Fix: Layout Manager: the space between hierarchy entries changed when expanding the hierarchy
- WEBIQ-5596 Fix: Package update message was shown when creating a new HMI project after discarding a project that required package updates
WebIQ Server
- WEBIQ-5626 Fix: Items with min/max settings which were items instead of fixed values did no longer work
WebIQ General
- WEBIQ-5630 Fix: INSTALLER: a check for when the uninstaller fails has been added - failed silently before
Release Notes
Bugfix release for mainly fixing two bugs in WebIQ Designer and WebIQ Server - see below for details.
Please note that for WebIQ Designer the bug is caused by the installed version that on close sometimes resets the Launcher configuration (this has been an issue since the Launcher has been integrated). The bugfix release will prevent this from happening in the future, but cannot fix an already broken Launcher configuration. If you cannot connect to WebIQ Server from WebIQ Designer after upgrading consider creating a new entry in the Launcher configuration that does not use HTTPS (HTTPS is indicated by a lock next to the IP address).
Also fixes WEBIQ-5626 which might be a critical issue for you when using min/max items for another item instead of min/max values.
Known Issues
This section contains known functional or technical product issues. Security vulnerabilities are shown separately under “Known vulnerabilities”.
no known issues to date
Known Vulnerabilities
VDR + VEXThis sections lists all evaluated, confirmed and non-confirmed vulnerabilities found in WebIQ or its components. For supported versions the vulnerabilities are evaluated in a timely manner by our development team. In case of exploitable vulnerabilities in supported versions new versions will be made available.
Summary by Component
| WebIQ Component | Total | Highest severity | Distribution |
|---|---|---|---|
| CONNECTWebIQ Server | 3 | LOW3.7 | 3 LOW |
| DESIGNERWebIQ Designer | 6 | CRITICAL9.1 | 1 CRITICAL · 2 HIGH · 1 MEDIUM · 2 LOW |
| MODBUSIOHandler ModBus | 4 | MEDIUM5.3 | 1 MEDIUM · 3 LOW |
| OPCUAIOHandler OPC-UA | 4 | MEDIUM5.3 | 1 MEDIUM · 3 LOW |
1. Present in components, but not actively exploitable in the WebIQ context28
This section lists known vulnerabilities in components used by WebIQ that we have validated are not exploitable in WebIQ.
| Identifier | External Dependency | WebIQ Component | Assessment | Severity | Note |
|---|---|---|---|---|---|
| CVE-2026-84782 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | HIGH8.2 | DTLS not used by WebIQ |
| CVE-2026-84782 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | HIGH8.2 | DTLS not used by WebIQ |
| CVE-2026-84782 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not affected / not exploitable | HIGH8.2 | DTLS not used by WebIQ |
| CVE-2026-54873 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | HIGH7.5 | QUIC not used by WebIQ |
| CVE-2026-54873 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | HIGH7.5 | QUIC not used by WebIQ |
| CVE-2026-54873 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not affected / not exploitable | HIGH7.5 | QUIC not used by WebIQ |
| CVE-2026-72897 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | HIGH7.5 | WebIQ does not do what is required to trigger the issue. Neither it nor its TLS reliant dependencies (Boost.Asio, Unified Automation UaSDK) call SSL_set_SSL_CTX part way through a handshake. |
| CVE-2026-72897 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | HIGH7.5 | WebIQ does not do what is required to trigger the issue. Neither it nor its TLS reliant dependencies (Boost.Asio, Unified Automation UaSDK) call SSL_set_SSL_CTX part way through a handshake. |
| CVE-2026-72897 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not affected / not exploitable | HIGH7.5 | WebIQ does not do what is required to trigger the issue. Neither it nor its TLS reliant dependencies (Boost.Asio, Unified Automation UaSDK) call SSL_set_SSL_CTX part way through a handshake. |
| CVE-2026-84784 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | HIGH7.5 | QUIC not used by WebIQ |
| CVE-2026-84784 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | HIGH7.5 | QUIC not used by WebIQ |
| CVE-2026-84784 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not affected / not exploitable | HIGH7.5 | QUIC not used by WebIQ |
| CVE-2026-35189 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | MEDIUM5.3 | WebIQ only processes certificates when connecting to external, Smart HMI controlled endpoints (for floating-licenses). To exploit this issue, one would have to spoof the DNS records of these endpoints to redirect traffic to a malicious server, causing the local WebIQ instance to no longer recognize the floating-license. The instances that use WebIQ floating licenses are (mostly) development systems with sufficient memory available to run multiple web browsers in parallel. The memory blowup, while not good, will not cause the system to go out of memory. |
| CVE-2026-42772 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | MEDIUM5.3 | QUIC not used by WebIQ |
| CVE-2026-42772 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | MEDIUM5.3 | QUIC not used by WebIQ |
| CVE-2026-42772 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not affected / not exploitable | MEDIUM5.3 | QUIC not used by WebIQ |
| CVE-2026-75804 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | MEDIUM5.3 | QUIC not used by WebIQ |
| CVE-2026-75804 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | MEDIUM5.3 | QUIC not used by WebIQ |
| CVE-2026-75804 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not affected / not exploitable | MEDIUM5.3 | QUIC not used by WebIQ |
| CVE-2026-75805 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | MEDIUM5.3 | CMP not used by WebIQ |
| CVE-2026-75805 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | MEDIUM5.3 | CMP not used by WebIQ |
| CVE-2026-75805 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not affected / not exploitable | MEDIUM5.3 | CMP not used by WebIQ |
| CVE-2026-75806 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | MEDIUM5.3 | DTLS not used by WebIQ |
| CVE-2026-75806 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | MEDIUM5.3 | DTLS not used by WebIQ |
| CVE-2026-75806 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not affected / not exploitable | MEDIUM5.3 | DTLS not used by WebIQ |
| CVE-2026-35191 | openssl 3.5.8 |
WebIQ Server
|
Not affected / not exploitable | LOW3.7 | QUIC not used by WebIQ |
| CVE-2026-35191 | openssl 3.5.8 |
IOHandler ModBus
|
Not affected / not exploitable | LOW3.7 | QUIC not used by WebIQ |
| CVE-2026-35191 | openssl 3.5.8 |
IOHandler OPC-UA
|
Not affected / not exploitable | LOW3.7 | QUIC not used by WebIQ |
2. Exploitable, but no active exploitation in WebIQ known or reported11
These components are technically exploitable in WebIQ context, but no active exploitation is known or reported.
| Identifier | External Dependency | WebIQ Component | Assessment | Severity | Source | Note |
|---|---|---|---|---|---|---|
| CVE-2026-35189 | openssl 3.5.8 |
IOHandler ModBus
|
Exploitable; no active WebIQ exploitation known | MEDIUM5.3 | VEX | The vulnerability is technically relevant; active exploitation against WebIQ is not known or reported. |
| CVE-2026-35189 | openssl 3.5.8 |
IOHandler OPC-UA
|
Exploitable; no active WebIQ exploitation known | MEDIUM5.3 | VEX | The vulnerability is technically relevant; active exploitation against WebIQ is not known or reported. |
| CVE-2026-54872 | openssl 3.5.8 |
WebIQ Server
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-54872 | openssl 3.5.8 |
IOHandler ModBus
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-54872 | openssl 3.5.8 |
IOHandler OPC-UA
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-54875 | openssl 3.5.8 |
WebIQ Server
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-54875 | openssl 3.5.8 |
IOHandler ModBus
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-54875 | openssl 3.5.8 |
IOHandler OPC-UA
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-77696 | openssl 3.5.8 |
WebIQ Server
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-77696 | openssl 3.5.8 |
IOHandler ModBus
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
| CVE-2026-77696 | openssl 3.5.8 |
IOHandler OPC-UA
|
Exploitable; no active WebIQ exploitation known | LOW3.7 | VEX | Theoretically exploitable with users configuring their TLS listeners with one of the affected curves. Practically nobody does this though so the actual impact is effectively zero. |
3. Actively exploited in WebIQ0
This category lists known exploitations of vulnerabilities in WebIQ. These will also be reported to ENISA.
No active exploitation in WebIQ is currently known or reported.
4. Unevaluated Vulnerabilities6
This section contains potential vulnerabilities that have not been fully evaluated by Smart-HMI. This usually only happens for supported releases.
This WebIQ version is no longer supported. Unevaluated vulnerabilities should therefore be treated as exploitable as a precaution. Upgrade to the latest supported version 2.21.0.
| Identifier | External Dependency | WebIQ Component | Assessment | Severity |
|---|---|---|---|---|
| GHSA-jqcg-44mw-7w3h | proxy-addr 2.0.7 |
WebIQ Designer
|
Not assessed by Smart-HMI | CRITICAL9.1 |
| GHSA-6j4f-fj2g-mc7p | brace-expansion 5.0.9 |
WebIQ Designer
|
Not assessed by Smart-HMI | HIGH7.5 |
| GHSA-qhr7-859c-m2p7 | brace-expansion 5.0.9 |
WebIQ Designer
|
Not assessed by Smart-HMI | HIGH7.5 |
| GHSA-q2hr-2g5m-vwhr | brace-expansion 5.0.9 |
WebIQ Designer
|
Not assessed by Smart-HMI | MEDIUM5.3 |
| GHSA-p98j-92pf-mc4p | dompurify 3.4.15 |
WebIQ Designer
|
Not assessed by Smart-HMI | LOW2.3 |
| GHSA-6688-9rhm-gjv2 | dompurify 3.4.15 |
WebIQ Designer
|
Not assessed by Smart-HMI | LOW |