Version
2.21.0
Supportstatus
Unterstützt
SBOMs
5/5
VDR-Dokumente
5
VEX-Dokumente
5
WebIQ-Komponenten & Security-Artefakte
Automatisch aus supplychain/versions: version.json, SBOM, VDR und VEX
| Komponente | Version | SBOM | VDR | VEX | Artefakte |
|---|---|---|---|---|---|
WebIQ Server CONNECT |
2.21.0 |
CycloneDX 1.5 · 13 Bestandteile
|
0 bekannte Schwachstelle(n) · 15.10.2026 07:16
|
0 Bewertung(en) · 15.10.2026 07:16
|
SBOM VDR VEX |
WebIQ Designer DESIGNER |
2.21.0 |
CycloneDX 1.5 · 198 Bestandteile
|
2 bekannte Schwachstelle(n) · 22.10.2026 10:23
|
2 Bewertung(en) · 22.10.2026 10:23
|
SBOM VDR VEX |
IOHandler ModBus MODBUS |
1.0.1 |
CycloneDX 1.5 · 3 Bestandteile
|
0 bekannte Schwachstelle(n) · 15.10.2026 07:16
|
0 Bewertung(en) · 15.10.2026 07:16
|
SBOM VDR VEX |
IOHandler OPC-UA OPCUA |
2.5.2 |
CycloneDX 1.5 · 5 Bestandteile
|
0 bekannte Schwachstelle(n) · 15.10.2026 07:16
|
0 Bewertung(en) · 15.10.2026 07:16
|
SBOM VDR VEX |
WebIQ Portable PORTABLE |
1.2.0 |
CycloneDX 1.5 · 1 Bestandteile
|
0 bekannte Schwachstelle(n) · 15.10.2026 07:16
|
0 Bewertung(en) · 15.10.2026 07:16
|
SBOM VDR VEX |
Changelog
WebIQ 2.21.0 Changelog
WebIQ Designer
- WEBIQ-5646 User Manager: added recovery user option
- WEBIQ-5607 [CYBERSECURITY] EU CRA CE compliance info added
- WEBIQ-5588 [CYBERSECURITY] Added functions for initial user creation after user reset via Runtime Manager
- WEBIQ-5582 Process Data Manager: Browse function: to ease the load on an OPC UA server the tree is not read recursively anymore
- WEBIQ-5533 Layout Manager: Condition Dialog: CSS Modifiers/Locking/Responsive Menu: strings can now be used for condition comparisons
- WEBIQ-5454 Single-selection dialogs should be applicable on double-click on a selectable entry
- WEBIQ-5423 Condition Dialog: now more than two conditions can be specified for CSS Modifiers, lock conditions and responsive menu entries
- WEBIQ-4966 Recipe Manager: recipe items can now be sorted manually
- WEBIQ-3577 Project List: last used date is now shown
- WEBIQ-5653 Fix: RM: log settings were incorrectly applied: Fatal -> Critical, Warning -> Notification even though obsolete. Obsolete log options have now been removed
- WEBIQ-5631 Fix: Code Manager: when deleting a LocalScript referenced by a Recipe Edit Desiger got stuck in loading screen
- WEBIQ-5620 Fix: Localization was missing for the project import dialog placeholders
- WEBIQ-5597 Fix: Layout Manager: the space between hierarchy entries changed when expanding the hierarchy
- WEBIQ-5596 Fix: Package update message was shown when creating a new HMI project after discarding a project that required package updates
- WEBIQ-5594 Fix: Localization Manager: the "show locale" popup was not correctly positioned over the configuration button
- WEBIQ-5585 Fix: Layout Manager: active IQ-Styles were not updated inside the selector select-box
WebIQ Visuals
- WEBIQ-5654 General: workaround for Google bfcache behavior sometimes keeping connections open after logout leading to a blocked license
- WEBIQ-5624 [CYBERSECURITY] Login Screen: user selection dropdown now disabled by default to follow "secure by default" EU CRA guidelines - only for new HMIs
- WEBIQ-5621 Audit Log Viewer: new texts added for newly added audit record types
- WEBIQ-5587 [CYBERSECURITY] Added functions for initial user creation after user reset via Runtime Manager
- WEBIQ-5500 IQ&MD AlarmInfo: added new "only highest priority" option
- WEBIQ-5407 UI Action "trend-export-csv": new options were added for customization
- WEBIQ-3294 IQ & MD Overlay Keyboard: on numeric values show numpad automatically
- WEBIQ-5655 Fix: MD & IQ AlarmList: content was not shown correctly in certain constellations when inside a Swipe Panel
- WEBIQ-5652 Fix: Login page: on smaller resolutions certain components were not positioned correctly
- WEBIQ-5633 Fix: MD Slider: when item min/max changed the display was not always updated correctly
- WEBIQ-5632 Fix: MD Linear Gauge: when item min/max changed the display was not always updated correctly
- WEBIQ-5629 Fix: IQ AlarmList: detail view did not use alarmlist_dateformat localization variable
- WEBIQ-5601 Fix: MD Trend Zoom: vertical layout did not work, was shown as horizontal
- WEBIQ-5595 Fix: IQ/MD widgets: several widgets allowed customization of a label even when the widget did not have a label
WebIQ Server
- WEBIQ-5659 OpenSSL has been updated to version 3.5.9
- WEBIQ-5656 FESTO: Changed name and supplier info to Smart-HMI/WebIQ
- WEBIQ-5608 [CYBERSECURITY] Runtime Manager: EU CRA CE compliance info added
- WEBIQ-5600 [CYBERSECURITY] Disabled user.login_list command by default for new HMIs to prevent user names from becoming known
- WEBIQ-5440 When factory resetting user data (from 2.19.0), all user and group information is discarded (as expected). However the HMI was left in an inaccessible state.
- WEBIQ-5436 Runtime Manager: system audit log has been added
- WEBIQ-4888 Trend: When an item in a Trend is not available and the trend is running and then later becomes available it was not shown
- WEBIQ-5643 Fix: RM: log settings were incorrectly applied: Fatal -> Critical, Warning -> Notification even though obsolete. Obsolete log options have now been removed
- WEBIQ-5626 Fix: Items with min/max settings which were items instead of fixed values did no longer work
- WEBIQ-5604 Fix: Fixed a crash in 2.20.0 when the connection is closed but some data is still in the send queue
Release Notes
WebIQ 2.21.0 Release Notes
This release aims to close the last gaps for EU CRA compliance and also includes several fixes and features.
Please note that if you want to reset all users before deploying the HMI on the target system to prevent users with default credentials you have to manually tick the box "Recovery User" in User Manager for the user you wish to use for setting up your users on the runtime system. There can only be one user that needs administrative privileges to setup the users again.
Bekannte Issues
Dieser Bereich enthält bekannte funktionale oder technische Produktprobleme. Sicherheitslücken werden separat im Abschnitt „Bekannte Sicherheitslücken“ aus VDR/VEX dargestellt.
no known issues to date
Bekannte Sicherheitslücken
VDR + VEXDie Menge der bekannten Sicherheitslücken stammt primär aus den komponentenbezogenen vdr.json-Dateien. Eine passende VEX-Bewertung überschreibt den unbewerteten VDR-Status und bestimmt die WebIQ-spezifische Ausnutzbarkeit. Schwachstellen, die im VDR vorhanden sind, aber noch nicht durch Smart-HMI bewertet wurden, erscheinen automatisch als nicht evaluiert.
Zusammenfassung nach Komponenten
Für diese Version sind derzeit keine ausnutzbaren oder noch nicht durch Smart-HMI bewerteten Sicherheitslücken erfasst.
1. In Komponenten enthalten, aber im WebIQ-Kontext nicht aktiv ausnutzbar2
Hier erscheinen VEX-Einträge mit Zuständen wie not_affected, false_positive oder resolved.
| Kennung | External Dependency | WebIQ-Komponente | Bewertung | Schweregrad | Hinweis |
|---|---|---|---|---|---|
| GHSA-gfr2-rv44-r23c | markdown-it 14.3.2 |
WebIQ Designer
|
Nicht betroffen / nicht ausnutzbar | HIGH7.5 | The only user-input that is rendered as markdown is a certificate's name in the certificate information dialog. While the quadratic-time issue is theoretically exploitable there, the total name length is limited by the maximum websocket frame size allowed by WebIQ Server. Even at the longest possible name, the electron renderer still takes longer (a couple of seconds) to render the text from the PoC than it takes markdown to process it. |
| GHSA-vfgh-jcmw-g37q | markdown-it 14.3.2 |
WebIQ Designer
|
Nicht betroffen / nicht ausnutzbar | LOW3.7 | `html: true` is not set for any paths using `markdown-it`. |
2. Aktiv ausnutzbar, aber keine aktive Ausnutzung in WebIQ bekannt oder gemeldet0
Hier erscheinen VEX-Einträge mit analysis.state = exploitable, sofern keine explizite aktive Ausnutzung in WebIQ gekennzeichnet wurde.
Aktuell wurden aus den vorhandenen VDR-/VEX-Dateien keine entsprechenden Schwachstellen ermittelt.
3. Aktiv in WebIQ ausgenutzt0
Diese Kategorie wird nur befüllt, wenn der VEX-Datensatz die aktive Ausnutzung in WebIQ explizit kennzeichnet.
Bisher keine bekannte oder gemeldete aktive Ausnutzung in WebIQ.
4. Noch nicht evaluierte Sicherheitslücken0
Hier erscheinen insbesondere Schwachstellen aus vdr.json, für die noch kein passender Eintrag in der VEX-Datei der Komponente vorliegt. Zusätzlich werden VEX-Einträge mit noch nicht abschließend bewertetem Status hier geführt.
Aktuell liegen keine noch nicht abschließend evaluierten Sicherheitslücken vor.