Version

2.21.0

Support status

Supported

SBOMs

5/5

VDR documents

VEX & VDR documents

WebIQ Components & Security Artifacts Updated automatically

Component	Version	SBOM	VDR	VEX	Artifacts
WebIQ Server `CONNECT`	2.21.0	CycloneDX 1.5 · 13 components	0 known vulnerability/vulnerabilities · 2026-10-15 07:16	0 assessment(s) · 2026-10-15 07:16	SBOM VDR VEX
WebIQ Designer `DESIGNER`	2.21.0	CycloneDX 1.5 · 198 components	2 known vulnerability/vulnerabilities · 2026-10-22 10:23	2 assessment(s) · 2026-10-22 10:23	SBOM VDR VEX
IOHandler ModBus `MODBUS`	1.0.1	CycloneDX 1.5 · 3 components	0 known vulnerability/vulnerabilities · 2026-10-15 07:16	0 assessment(s) · 2026-10-15 07:16	SBOM VDR VEX
IOHandler OPC-UA `OPCUA`	2.5.2	CycloneDX 1.5 · 5 components	0 known vulnerability/vulnerabilities · 2026-10-15 07:16	0 assessment(s) · 2026-10-15 07:16	SBOM VDR VEX
WebIQ Portable `PORTABLE`	1.2.0	CycloneDX 1.5 · 1 components	0 known vulnerability/vulnerabilities · 2026-10-15 07:16	0 assessment(s) · 2026-10-15 07:16	SBOM VDR VEX

Changelog

WebIQ 2.21.0 Changelog

WebIQ Designer

WEBIQ-5646 User Manager: added recovery user option
WEBIQ-5607 [CYBERSECURITY] EU CRA CE compliance info added
WEBIQ-5588 [CYBERSECURITY] Added functions for initial user creation after user reset via Runtime Manager
WEBIQ-5582 Process Data Manager: Browse function: to ease the load on an OPC UA server the tree is not read recursively anymore
WEBIQ-5533 Layout Manager: Condition Dialog: CSS Modifiers/Locking/Responsive Menu: strings can now be used for condition comparisons
WEBIQ-5454 Single-selection dialogs should be applicable on double-click on a selectable entry
WEBIQ-5423 Condition Dialog: now more than two conditions can be specified for CSS Modifiers, lock conditions and responsive menu entries
WEBIQ-4966 Recipe Manager: recipe items can now be sorted manually
WEBIQ-3577 Project List: last used date is now shown
WEBIQ-5653 Fix: RM: log settings were incorrectly applied: Fatal -> Critical, Warning -> Notification even though obsolete. Obsolete log options have now been removed
WEBIQ-5631 Fix: Code Manager: when deleting a LocalScript referenced by a Recipe Edit Desiger got stuck in loading screen
WEBIQ-5620 Fix: Localization was missing for the project import dialog placeholders
WEBIQ-5597 Fix: Layout Manager: the space between hierarchy entries changed when expanding the hierarchy
WEBIQ-5596 Fix: Package update message was shown when creating a new HMI project after discarding a project that required package updates
WEBIQ-5594 Fix: Localization Manager: the "show locale" popup was not correctly positioned over the configuration button
WEBIQ-5585 Fix: Layout Manager: active IQ-Styles were not updated inside the selector select-box

WebIQ Visuals

WEBIQ-5654 General: workaround for Google bfcache behavior sometimes keeping connections open after logout leading to a blocked license
WEBIQ-5624 [CYBERSECURITY] Login Screen: user selection dropdown now disabled by default to follow "secure by default" EU CRA guidelines - only for new HMIs
WEBIQ-5621 Audit Log Viewer: new texts added for newly added audit record types
WEBIQ-5587 [CYBERSECURITY] Added functions for initial user creation after user reset via Runtime Manager
WEBIQ-5500 IQ&MD AlarmInfo: added new "only highest priority" option
WEBIQ-5407 UI Action "trend-export-csv": new options were added for customization
WEBIQ-3294 IQ & MD Overlay Keyboard: on numeric values show numpad automatically
WEBIQ-5655 Fix: MD & IQ AlarmList: content was not shown correctly in certain constellations when inside a Swipe Panel
WEBIQ-5652 Fix: Login page: on smaller resolutions certain components were not positioned correctly
WEBIQ-5633 Fix: MD Slider: when item min/max changed the display was not always updated correctly
WEBIQ-5632 Fix: MD Linear Gauge: when item min/max changed the display was not always updated correctly
WEBIQ-5629 Fix: IQ AlarmList: detail view did not use alarmlist_dateformat localization variable
WEBIQ-5601 Fix: MD Trend Zoom: vertical layout did not work, was shown as horizontal
WEBIQ-5595 Fix: IQ/MD widgets: several widgets allowed customization of a label even when the widget did not have a label

WebIQ Server

WEBIQ-5659 OpenSSL has been updated to version 3.5.9
WEBIQ-5656 FESTO: Changed name and supplier info to Smart-HMI/WebIQ
WEBIQ-5608 [CYBERSECURITY] Runtime Manager: EU CRA CE compliance info added
WEBIQ-5600 [CYBERSECURITY] Disabled user.login_list command by default for new HMIs to prevent user names from becoming known
WEBIQ-5440 When factory resetting user data (from 2.19.0), all user and group information is discarded (as expected). However the HMI was left in an inaccessible state.
WEBIQ-5436 Runtime Manager: system audit log has been added
WEBIQ-4888 Trend: When an item in a Trend is not available and the trend is running and then later becomes available it was not shown
WEBIQ-5643 Fix: RM: log settings were incorrectly applied: Fatal -> Critical, Warning -> Notification even though obsolete. Obsolete log options have now been removed
WEBIQ-5626 Fix: Items with min/max settings which were items instead of fixed values did no longer work
WEBIQ-5604 Fix: Fixed a crash in 2.20.0 when the connection is closed but some data is still in the send queue

Release Notes

WebIQ 2.21.0 Release Notes

This release aims to close the last gaps for EU CRA compliance and also includes several fixes and features.

Please note that if you want to reset all users before deploying the HMI on the target system to prevent users with default credentials you have to manually tick the box "Recovery User" in User Manager for the user you wish to use for setting up your users on the runtime system. There can only be one user that needs administrative privileges to setup the users again.

Known Issues

This section contains known functional or technical product issues. Security vulnerabilities are shown separately under “Known vulnerabilities”.

no known issues to date

Known Vulnerabilities

VDR + VEX

This sections lists all evaluated, confirmed and non-confirmed vulnerabilities found in WebIQ or its components. For supported versions the vulnerabilities are evaluated in a timely manner by our development team. In case of exploitable vulnerabilities in supported versions new versions will be made available.

Summary by Component

No exploitable or not-yet-assessed vulnerabilities are currently recorded for this version.

1. Present in components, but not actively exploitable in the WebIQ context2

This section lists known vulnerabilities in components used by WebIQ that we have validated are not exploitable in WebIQ.

Identifier	External Dependency	WebIQ Component	Assessment	Severity	Note
GHSA-gfr2-rv44-r23c	markdown-it 14.3.2	WebIQ Designer	Not affected / not exploitable	HIGH7.5	The only user-input that is rendered as markdown is a certificate's name in the certificate information dialog. While the quadratic-time issue is theoretically exploitable there, the total name length is limited by the maximum websocket frame size allowed by WebIQ Server. Even at the longest possible name, the electron renderer still takes longer (a couple of seconds) to render the text from the PoC than it takes markdown to process it.
GHSA-vfgh-jcmw-g37q	markdown-it 14.3.2	WebIQ Designer	Not affected / not exploitable	LOW3.7	`html: true` is not set for any paths using `markdown-it`.

2. Exploitable, but no active exploitation in WebIQ known or reported0

These components are technically exploitable in WebIQ context, but no active exploitation is known or reported.

No corresponding vulnerabilities were determined from the available VDR/VEX files.

3. Actively exploited in WebIQ0

This category lists known exploitations of vulnerabilities in WebIQ. These will also be reported to ENISA.

No active exploitation in WebIQ is currently known or reported.

4. Not yet evaluated vulnerabilities0

This section contains potential vulnerabilities that have not been fully evaluated by Smart-HMI. This usually only happens for supported releases.

There are currently no vulnerabilities awaiting final evaluation.