Search criteria
12 vulnerabilities found for com-server_highspeed_100baselx_firmware by wut
FKIE_CVE-2022-4098
Vulnerability from fkie_nvd - Published: 2022-12-13 08:15 - Updated: 2024-11-21 07:34
Severity ?
8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.
References
| URL | Tags | ||
|---|---|---|---|
| info@cert.vde.com | https://cert.vde.com/en/advisories/VDE-2022-057/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert.vde.com/en/advisories/VDE-2022-057/ | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_\\+\\+_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "85F074B2-B298-4125-898E-211B929B1B30",
"versionEndExcluding": "1.55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_\\+\\+:-:*:*:*:*:*:*:*",
"matchCriteriaId": "95A959DC-16BA-4F52-BC0E-8C005C00B20B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_20ma_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5DD7E27B-5D2F-4F1A-994B-4C08A7F37819",
"versionEndExcluding": "1.55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_20ma:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ED79295D-3E94-4396-ADB0-A346B0A2AF63",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_100basefx_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FD46E633-773F-4828-A672-C1A97B934EA5",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_100basefx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7624DA1-E509-4BAA-A44C-BC4E16D9FCB1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_100baselx_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CD9D3C42-62EB-4121-851B-6A89EEFFF322",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_100baselx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B36DF0EE-58C2-4CC4-99C8-55FCDDC9597B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_19\\\"_1port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A7ACA14-EA04-47AF-BF35-8487F6D22CA2",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_19\\\"_1port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "65311BF2-70D2-475B-A314-0465FAA24E7F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_19\\\"_4port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A99FC278-A3E3-4619-B0BD-A9C3B9B5FE93",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_19\\\"_4port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0099261-FBC5-4C6D-8558-E7F4BAD401AB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_compact_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E615A9CE-9E05-4336-AD4A-234CF4D2987F",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_compact:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0E0076-658C-49E2-ACEF-A4109A22DEDA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_industry_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "94183D3F-CC93-4874-822D-605651E75179",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_industry:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E1ACF76-3B54-4960-9A44-19F5CED2216C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_isolated_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "09F2FD05-6903-42D1-8F59-E5F2950624FE",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_isolated:-:*:*:*:*:*:*:*",
"matchCriteriaId": "53646CB3-FAC9-447B-8762-66E20790041F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_oem_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6D88E1A-56E2-4FF3-AE30-008D4B70C02A",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_oem:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A47245FC-FDD7-40E6-B78F-28E5902E052D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_office_1port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79636A77-444A-4D0B-825A-738D019A7981",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_office_1port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "62A566FD-B617-45DC-B0E8-D130C0BCF13E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_office_4port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "535C0C59-A888-43D5-82C7-A1CEF8977527",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_office_4port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "255D4A95-1A11-45F7-B14F-BC74F6D190AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_poe_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B85E5173-162C-41A7-8D08-E4021789DAA4",
"versionEndExcluding": "1.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_poe:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E25680B-D264-4562-B3AB-D6BAF0BEA433",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_lc_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "18EF3531-3040-4DDA-AE56-DBAF1FA8DB6C",
"versionEndExcluding": "1.55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_lc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0567E35-5011-4C17-8737-A20F55922F59",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_poe_3x_isolated_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "77F3C69D-6EAF-49CF-B961-A570F94A6E1B",
"versionEndExcluding": "1.55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_poe_3x_isolated:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F851852B-75EA-4F1C-8BFB-DE29394D510B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_ul_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4BA1D1BD-7CAD-4A9E-87DC-B5198948FD5B",
"versionEndExcluding": "1.55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_ul:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5C5BB32C-F7B5-4E34-A60A-DDA084EB3F45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple Wiesemann\u0026Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device."
},
{
"lang": "es",
"value": "Varios productos de Wiesemann\u0026amp;Theis de la serie ComServer son propensos a omitir la autenticaci\u00f3n debido a la suplantaci\u00f3n de IP. Despu\u00e9s de que un usuario inicia sesi\u00f3n en el WBM del Com-Server, un atacante no autenticado en la misma subred puede obtener el ID de la sesi\u00f3n y, a trav\u00e9s de la suplantaci\u00f3n de IP, cambiar configuraciones arbitrarias mediante la creaci\u00f3n de solicitudes HTTP Get modificadas. Esto puede resultar en una adquisici\u00f3n total del dispositivo."
}
],
"id": "CVE-2022-4098",
"lastModified": "2024-11-21T07:34:34.737",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "info@cert.vde.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
},
"published": "2022-12-13T08:15:10.283",
"references": [
{
"source": "info@cert.vde.com",
"tags": [
"Vendor Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-057/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-057/"
}
],
"sourceIdentifier": "info@cert.vde.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-290"
}
],
"source": "info@cert.vde.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2022-42785
Vulnerability from fkie_nvd - Published: 2022-11-15 21:15 - Updated: 2024-11-21 07:25
Severity ?
Summary
Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.
References
| URL | Tags | ||
|---|---|---|---|
| info@cert.vde.com | https://cert.vde.com/de/advisories/VDE-2022-043/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert.vde.com/de/advisories/VDE-2022-043/ | Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:at-modem-emulator_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3D1C1F81-27B4-40D1-A5BD-28A20E85426A",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:at-modem-emulator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C4BCB98-14B9-4B24-AC86-88778BE94A1A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_\\+\\+_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6D694696-F36F-48EF-9902-3EC4B17436C3",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_\\+\\+:-:*:*:*:*:*:*:*",
"matchCriteriaId": "95A959DC-16BA-4F52-BC0E-8C005C00B20B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_20ma_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73EFD090-75E1-4626-83BC-F90C66C492C1",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_20ma:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ED79295D-3E94-4396-ADB0-A346B0A2AF63",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_100basefx_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6A68F28E-5EEF-4318-B146-97F87CA8DEF0",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_100basefx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7624DA1-E509-4BAA-A44C-BC4E16D9FCB1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_100baselx_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "65D19EE8-3570-4C87-B8E6-9450FD575587",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_100baselx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B36DF0EE-58C2-4CC4-99C8-55FCDDC9597B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_19\\\"_1port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04FF98FC-5480-4F36-8257-0622229B55BF",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_19\\\"_1port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "65311BF2-70D2-475B-A314-0465FAA24E7F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_19\\\"_4port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F211D204-8DF4-436F-97ED-E96439FA1405",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_19\\\"_4port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0099261-FBC5-4C6D-8558-E7F4BAD401AB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_compact_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D5A39967-43C7-490A-9A4E-8D2304D6F6BB",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_compact:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0E0076-658C-49E2-ACEF-A4109A22DEDA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_industry_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F45FCF96-6419-4BD4-9646-6853E1753571",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_industry:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E1ACF76-3B54-4960-9A44-19F5CED2216C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_isolated_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BB67B2D9-F924-47F1-937B-C6AC5BE63BBC",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_isolated:-:*:*:*:*:*:*:*",
"matchCriteriaId": "53646CB3-FAC9-447B-8762-66E20790041F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_oem_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48836121-BB41-4E0E-A8F6-085EA12C3EC2",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_oem:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A47245FC-FDD7-40E6-B78F-28E5902E052D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_office_1port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "31849A47-81EE-40F2-986B-67041583E9F4",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_office_1port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "62A566FD-B617-45DC-B0E8-D130C0BCF13E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_office_4port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DBF947FE-F111-4A2D-A78C-F6CE6139860F",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_office_4port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "255D4A95-1A11-45F7-B14F-BC74F6D190AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_poe_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2CA2668-1B7D-48F3-9310-0CE6FA036645",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_poe:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E25680B-D264-4562-B3AB-D6BAF0BEA433",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_lc_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8DFE2270-9EFA-4185-860A-BDB6A8024B5D",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_lc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0567E35-5011-4C17-8737-A20F55922F59",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_ul_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "68BD57D3-8F57-4A94-BD6C-FFD157DE0FFD",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_ul:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5C5BB32C-F7B5-4E34-A60A-DDA084EB3F45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_poe_3x_isolated_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C3ABB392-20C8-401E-9968-7A1FB578F07B",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_poe_3x_isolated:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F851852B-75EA-4F1C-8BFB-DE29394D510B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple W\u0026T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request."
},
{
"lang": "es",
"value": "Varios productos W\u0026amp;T de la serie ComServer son propensos a sufrir una omisi\u00f3n de autenticaci\u00f3n. Un atacante remoto no autenticado puede iniciar sesi\u00f3n sin conocer la contrase\u00f1a creando una solicitud HTTP GET modificada."
}
],
"id": "CVE-2022-42785",
"lastModified": "2024-11-21T07:25:20.317",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "info@cert.vde.com",
"type": "Secondary"
}
]
},
"published": "2022-11-15T21:15:38.237",
"references": [
{
"source": "info@cert.vde.com",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"sourceIdentifier": "info@cert.vde.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "info@cert.vde.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2022-42786
Vulnerability from fkie_nvd - Published: 2022-11-10 12:15 - Updated: 2024-11-21 07:25
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage
References
| URL | Tags | ||
|---|---|---|---|
| info@cert.vde.com | https://cert.vde.com/de/advisories/VDE-2022-043/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert.vde.com/de/advisories/VDE-2022-043/ | Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:at-modem-emulator_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3D1C1F81-27B4-40D1-A5BD-28A20E85426A",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:at-modem-emulator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C4BCB98-14B9-4B24-AC86-88778BE94A1A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_\\+\\+_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6D694696-F36F-48EF-9902-3EC4B17436C3",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_\\+\\+:-:*:*:*:*:*:*:*",
"matchCriteriaId": "95A959DC-16BA-4F52-BC0E-8C005C00B20B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_20ma_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73EFD090-75E1-4626-83BC-F90C66C492C1",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_20ma:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ED79295D-3E94-4396-ADB0-A346B0A2AF63",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_100basefx_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6A68F28E-5EEF-4318-B146-97F87CA8DEF0",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_100basefx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7624DA1-E509-4BAA-A44C-BC4E16D9FCB1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_100baselx_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "65D19EE8-3570-4C87-B8E6-9450FD575587",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_100baselx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B36DF0EE-58C2-4CC4-99C8-55FCDDC9597B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_19\\\"_1port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04FF98FC-5480-4F36-8257-0622229B55BF",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_19\\\"_1port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "65311BF2-70D2-475B-A314-0465FAA24E7F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_19\\\"_4port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F211D204-8DF4-436F-97ED-E96439FA1405",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_19\\\"_4port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0099261-FBC5-4C6D-8558-E7F4BAD401AB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_compact_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D5A39967-43C7-490A-9A4E-8D2304D6F6BB",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_compact:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0E0076-658C-49E2-ACEF-A4109A22DEDA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_industry_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F45FCF96-6419-4BD4-9646-6853E1753571",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_industry:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E1ACF76-3B54-4960-9A44-19F5CED2216C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_isolated_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BB67B2D9-F924-47F1-937B-C6AC5BE63BBC",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_isolated:-:*:*:*:*:*:*:*",
"matchCriteriaId": "53646CB3-FAC9-447B-8762-66E20790041F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_oem_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48836121-BB41-4E0E-A8F6-085EA12C3EC2",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_oem:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A47245FC-FDD7-40E6-B78F-28E5902E052D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_office_1port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "31849A47-81EE-40F2-986B-67041583E9F4",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_office_1port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "62A566FD-B617-45DC-B0E8-D130C0BCF13E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_office_4port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DBF947FE-F111-4A2D-A78C-F6CE6139860F",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_office_4port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "255D4A95-1A11-45F7-B14F-BC74F6D190AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_poe_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2CA2668-1B7D-48F3-9310-0CE6FA036645",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_poe:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E25680B-D264-4562-B3AB-D6BAF0BEA433",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_lc_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8DFE2270-9EFA-4185-860A-BDB6A8024B5D",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_lc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0567E35-5011-4C17-8737-A20F55922F59",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_ul_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "68BD57D3-8F57-4A94-BD6C-FFD157DE0FFD",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_ul:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5C5BB32C-F7B5-4E34-A60A-DDA084EB3F45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_poe_3x_isolated_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C3ABB392-20C8-401E-9968-7A1FB578F07B",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_poe_3x_isolated:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F851852B-75EA-4F1C-8BFB-DE29394D510B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple W\u0026T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage"
},
{
"lang": "es",
"value": "Productos multiples W\u0026amp;T de ComServer Series son propensos a sufrir un ataque XSS. Un atacante remoto autenticado puede ejecutar scripts web arbitrarios o HTML a trav\u00e9s de un payload manipulado inyectado en el t\u00edtulo de la p\u00e1gina web de configuraci\u00f3n."
}
],
"id": "CVE-2022-42786",
"lastModified": "2024-11-21T07:25:20.490",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "info@cert.vde.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
},
"published": "2022-11-10T12:15:10.063",
"references": [
{
"source": "info@cert.vde.com",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"sourceIdentifier": "info@cert.vde.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "info@cert.vde.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2022-42787
Vulnerability from fkie_nvd - Published: 2022-11-10 12:15 - Updated: 2024-11-21 07:25
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
References
| URL | Tags | ||
|---|---|---|---|
| info@cert.vde.com | https://cert.vde.com/de/advisories/VDE-2022-043 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert.vde.com/de/advisories/VDE-2022-043 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:at-modem-emulator_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3D1C1F81-27B4-40D1-A5BD-28A20E85426A",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:at-modem-emulator:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9C4BCB98-14B9-4B24-AC86-88778BE94A1A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_\\+\\+_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6D694696-F36F-48EF-9902-3EC4B17436C3",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_\\+\\+:-:*:*:*:*:*:*:*",
"matchCriteriaId": "95A959DC-16BA-4F52-BC0E-8C005C00B20B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_20ma_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73EFD090-75E1-4626-83BC-F90C66C492C1",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_20ma:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ED79295D-3E94-4396-ADB0-A346B0A2AF63",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_100basefx_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6A68F28E-5EEF-4318-B146-97F87CA8DEF0",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_100basefx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E7624DA1-E509-4BAA-A44C-BC4E16D9FCB1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_100baselx_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "65D19EE8-3570-4C87-B8E6-9450FD575587",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_100baselx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B36DF0EE-58C2-4CC4-99C8-55FCDDC9597B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_19\\\"_1port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04FF98FC-5480-4F36-8257-0622229B55BF",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_19\\\"_1port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "65311BF2-70D2-475B-A314-0465FAA24E7F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_19\\\"_4port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F211D204-8DF4-436F-97ED-E96439FA1405",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_19\\\"_4port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0099261-FBC5-4C6D-8558-E7F4BAD401AB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_compact_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D5A39967-43C7-490A-9A4E-8D2304D6F6BB",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_compact:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F0E0076-658C-49E2-ACEF-A4109A22DEDA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_industry_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F45FCF96-6419-4BD4-9646-6853E1753571",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_industry:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E1ACF76-3B54-4960-9A44-19F5CED2216C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_isolated_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BB67B2D9-F924-47F1-937B-C6AC5BE63BBC",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_isolated:-:*:*:*:*:*:*:*",
"matchCriteriaId": "53646CB3-FAC9-447B-8762-66E20790041F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_oem_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48836121-BB41-4E0E-A8F6-085EA12C3EC2",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_oem:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A47245FC-FDD7-40E6-B78F-28E5902E052D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_office_1port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "31849A47-81EE-40F2-986B-67041583E9F4",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_office_1port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "62A566FD-B617-45DC-B0E8-D130C0BCF13E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_office_4port_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DBF947FE-F111-4A2D-A78C-F6CE6139860F",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_office_4port:-:*:*:*:*:*:*:*",
"matchCriteriaId": "255D4A95-1A11-45F7-B14F-BC74F6D190AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_poe_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2CA2668-1B7D-48F3-9310-0CE6FA036645",
"versionEndExcluding": "1.76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_poe:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E25680B-D264-4562-B3AB-D6BAF0BEA433",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_lc_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8DFE2270-9EFA-4185-860A-BDB6A8024B5D",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_lc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B0567E35-5011-4C17-8737-A20F55922F59",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_ul_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "68BD57D3-8F57-4A94-BD6C-FFD157DE0FFD",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_ul:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5C5BB32C-F7B5-4E34-A60A-DDA084EB3F45",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:wut:com-server_highspeed_poe_3x_isolated_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C3ABB392-20C8-401E-9968-7A1FB578F07B",
"versionEndExcluding": "1.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:wut:com-server_highspeed_poe_3x_isolated:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F851852B-75EA-4F1C-8BFB-DE29394D510B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required."
},
{
"lang": "es",
"value": "Productos multiples W\u0026amp;T de Comserver Series utilizan un peque\u00f1o espacio num\u00e9rico para asignar identificadores de sesi\u00f3n. Despu\u00e9s de iniciar sesi\u00f3n de un usuario, un atacante remoto no autenticado puede forzar la identificaci\u00f3n de sesi\u00f3n del usuario y obtener acceso a su cuenta en el dispositivo. Como el usuario necesita iniciar sesi\u00f3n para que el ataque tenga \u00e9xito, se requiere la interacci\u00f3n del usuario."
}
],
"id": "CVE-2022-42787",
"lastModified": "2024-11-21T07:25:20.673",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "info@cert.vde.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
},
"published": "2022-11-10T12:15:10.927",
"references": [
{
"source": "info@cert.vde.com",
"tags": [
"Vendor Advisory"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043"
}
],
"sourceIdentifier": "info@cert.vde.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-330"
}
],
"source": "info@cert.vde.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-330"
}
],
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
}
CVE-2022-4098 (GCVE-0-2022-4098)
Vulnerability from cvelistv5 – Published: 2022-12-13 07:26 – Updated: 2025-04-14 18:12
VLAI?
Title
Wiesemann & Theis: Multiple products prone to missing authentication through spoofing
Summary
Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.
Severity ?
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
Credits
Wiesemann & Theis would like to thank Martin Weiß for responsibly disclosing this vulnerability.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:27:54.380Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-057/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-4098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T18:06:43.505209Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-14T18:12:33.668Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Com-Server ++",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server 20mA",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseFX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseLX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 1Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 4Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Compact",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Industry",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed OEM",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 1 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 4 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed PoE",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server LC",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server PoE 3 x Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server UL",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Wiesemann \u0026 Theis would like to thank Martin Wei\u00df for responsibly disclosing this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple Wiesemann\u0026amp;Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device."
}
],
"value": "Multiple Wiesemann\u0026Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device."
}
],
"impacts": [
{
"capecId": "CAPEC-151",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-151 Identity Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-12T09:48:16.966Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/en/advisories/VDE-2022-057/"
}
],
"source": {
"advisory": "VDE-2022-057",
"defect": [
"CERT@VDE#64297"
],
"discovery": "UNKNOWN"
},
"title": "Wiesemann \u0026 Theis: Multiple products prone to missing authentication through spoofing",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-4098",
"datePublished": "2022-12-13T07:26:17.752Z",
"dateReserved": "2022-11-21T11:21:00.430Z",
"dateUpdated": "2025-04-14T18:12:33.668Z",
"requesterUserId": "a1e5283b-8f0d-401e-98b2-bc6219c0e8d1",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-42787 (GCVE-0-2022-42787)
Vulnerability from cvelistv5 – Published: 2022-11-10 11:06 – Updated: 2025-05-01 19:01
VLAI?
Title
Wiesemann & Theis: Small number space for allocating session id in Com-Server family
Summary
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
Severity ?
8.8 (High)
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wiesemann & Theis | Com-Server LC |
Affected:
1.0 , < 1.48
(semver)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:19:04.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-42787",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-01T19:01:02.435905Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-01T19:01:20.740Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Com-Server LC",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server PoE 3 x Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server 20mA",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server ++",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AT-Modem-Emulator",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server UL",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseFX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseLX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 1 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 4 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Industry",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed OEM",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Compact",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 1Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 4Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed PoE",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-11-07T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple W\u0026amp;T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required."
}
],
"value": "Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required."
}
],
"impacts": [
{
"capecId": "CAPEC-112",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-112 Brute Force"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330 Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-01T13:56:46.185Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/de/advisories/VDE-2022-043"
}
],
"source": {
"advisory": "VDE-2022-043",
"defect": [
"CERT@VDE#64257"
],
"discovery": "EXTERNAL"
},
"title": "Wiesemann \u0026 Theis: Small number space for allocating session id in Com-Server family",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-42787",
"datePublished": "2022-11-10T11:06:20.856Z",
"dateReserved": "2022-10-11T13:32:19.672Z",
"dateUpdated": "2025-05-01T19:01:20.740Z",
"requesterUserId": "a1e5283b-8f0d-401e-98b2-bc6219c0e8d1",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-42786 (GCVE-0-2022-42786)
Vulnerability from cvelistv5 – Published: 2022-11-10 11:02 – Updated: 2025-04-29 14:56
VLAI?
Title
Wiesemann & Theis: XSS vulnerability in web interface of the Com-Server family
Summary
Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage
Severity ?
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wiesemann & Theis | Com-Server LC |
Affected:
1.0 , < 1.48
(semver)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:19:04.411Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-42786",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T14:56:37.167104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T14:56:50.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Com-Server LC",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server PoE 3 x Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server 20mA",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server ++",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AT-Modem-Emulator",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server UL",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseFX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseLX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 1 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 4 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Industry",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed OEM",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Compact",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 1Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 4Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed PoE",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-11-07T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple W\u0026amp;T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage"
}
],
"value": "Multiple W\u0026T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage"
}
],
"impacts": [
{
"capecId": "CAPEC-32",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-32 XSS Through HTTP Query Strings"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-16T08:53:50.333Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"source": {
"advisory": "VDE-2022-043",
"defect": [
"CERT@VDE#64257"
],
"discovery": "EXTERNAL"
},
"title": "Wiesemann \u0026 Theis: XSS vulnerability in web interface of the Com-Server family",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-42786",
"datePublished": "2022-11-10T11:02:32.615Z",
"dateReserved": "2022-10-11T13:32:19.672Z",
"dateUpdated": "2025-04-29T14:56:50.373Z",
"requesterUserId": "a1e5283b-8f0d-401e-98b2-bc6219c0e8d1",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-42785 (GCVE-0-2022-42785)
Vulnerability from cvelistv5 – Published: 2022-11-10 11:01 – Updated: 2025-05-01 19:02
VLAI?
Title
Wiesemann & Theis: Authentication bypass in Com-Server family
Summary
Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.
Severity ?
9.8 (Critical)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wiesemann & Theis | Com-Server LC |
Affected:
1.0 , < 1.48
(semver)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:19:04.510Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-42785",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-01T19:01:46.831217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-01T19:02:00.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Com-Server LC",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server PoE 3 x Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server 20mA",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server ++",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AT-Modem-Emulator",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server UL",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseFX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseLX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 1 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 4 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Industry",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed OEM",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Compact",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 1Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 4Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed PoE",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-11-07T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple W\u0026amp;T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request."
}
],
"value": "Multiple W\u0026T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T20:43:00.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"source": {
"advisory": "VDE-2022-043",
"defect": [
"CERT@VDE#64257"
],
"discovery": "EXTERNAL"
},
"title": "Wiesemann \u0026 Theis: Authentication bypass in Com-Server family",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-42785",
"datePublished": "2022-11-10T11:01:41.011Z",
"dateReserved": "2022-10-11T13:32:19.671Z",
"dateUpdated": "2025-05-01T19:02:00.365Z",
"requesterUserId": "a1e5283b-8f0d-401e-98b2-bc6219c0e8d1",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-4098 (GCVE-0-2022-4098)
Vulnerability from nvd – Published: 2022-12-13 07:26 – Updated: 2025-04-14 18:12
VLAI?
Title
Wiesemann & Theis: Multiple products prone to missing authentication through spoofing
Summary
Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.
Severity ?
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wiesemann & Theis | Com-Server ++ |
Affected:
0 , < 1.55
(semver)
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Credits
Wiesemann & Theis would like to thank Martin Weiß for responsibly disclosing this vulnerability.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:27:54.380Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/en/advisories/VDE-2022-057/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-4098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T18:06:43.505209Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-14T18:12:33.668Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Com-Server ++",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server 20mA",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseFX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseLX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 1Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 4Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Compact",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Industry",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed OEM",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 1 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 4 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed PoE",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.78",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server LC",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server PoE 3 x Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server UL",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.55",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Wiesemann \u0026 Theis would like to thank Martin Wei\u00df for responsibly disclosing this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple Wiesemann\u0026amp;Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device."
}
],
"value": "Multiple Wiesemann\u0026Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device."
}
],
"impacts": [
{
"capecId": "CAPEC-151",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-151 Identity Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-12T09:48:16.966Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/en/advisories/VDE-2022-057/"
}
],
"source": {
"advisory": "VDE-2022-057",
"defect": [
"CERT@VDE#64297"
],
"discovery": "UNKNOWN"
},
"title": "Wiesemann \u0026 Theis: Multiple products prone to missing authentication through spoofing",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-4098",
"datePublished": "2022-12-13T07:26:17.752Z",
"dateReserved": "2022-11-21T11:21:00.430Z",
"dateUpdated": "2025-04-14T18:12:33.668Z",
"requesterUserId": "a1e5283b-8f0d-401e-98b2-bc6219c0e8d1",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-42787 (GCVE-0-2022-42787)
Vulnerability from nvd – Published: 2022-11-10 11:06 – Updated: 2025-05-01 19:01
VLAI?
Title
Wiesemann & Theis: Small number space for allocating session id in Com-Server family
Summary
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
Severity ?
8.8 (High)
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wiesemann & Theis | Com-Server LC |
Affected:
1.0 , < 1.48
(semver)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:19:04.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-42787",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-01T19:01:02.435905Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-01T19:01:20.740Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Com-Server LC",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server PoE 3 x Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server 20mA",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server ++",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AT-Modem-Emulator",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server UL",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseFX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseLX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 1 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 4 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Industry",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed OEM",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Compact",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 1Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 4Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed PoE",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-11-07T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple W\u0026amp;T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required."
}
],
"value": "Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required."
}
],
"impacts": [
{
"capecId": "CAPEC-112",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-112 Brute Force"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330 Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-01T13:56:46.185Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/de/advisories/VDE-2022-043"
}
],
"source": {
"advisory": "VDE-2022-043",
"defect": [
"CERT@VDE#64257"
],
"discovery": "EXTERNAL"
},
"title": "Wiesemann \u0026 Theis: Small number space for allocating session id in Com-Server family",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-42787",
"datePublished": "2022-11-10T11:06:20.856Z",
"dateReserved": "2022-10-11T13:32:19.672Z",
"dateUpdated": "2025-05-01T19:01:20.740Z",
"requesterUserId": "a1e5283b-8f0d-401e-98b2-bc6219c0e8d1",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-42786 (GCVE-0-2022-42786)
Vulnerability from nvd – Published: 2022-11-10 11:02 – Updated: 2025-04-29 14:56
VLAI?
Title
Wiesemann & Theis: XSS vulnerability in web interface of the Com-Server family
Summary
Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage
Severity ?
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wiesemann & Theis | Com-Server LC |
Affected:
1.0 , < 1.48
(semver)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:19:04.411Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-42786",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T14:56:37.167104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T14:56:50.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Com-Server LC",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server PoE 3 x Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server 20mA",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server ++",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AT-Modem-Emulator",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server UL",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseFX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseLX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 1 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 4 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Industry",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed OEM",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Compact",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 1Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 4Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed PoE",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-11-07T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple W\u0026amp;T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage"
}
],
"value": "Multiple W\u0026T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage"
}
],
"impacts": [
{
"capecId": "CAPEC-32",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-32 XSS Through HTTP Query Strings"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-16T08:53:50.333Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"source": {
"advisory": "VDE-2022-043",
"defect": [
"CERT@VDE#64257"
],
"discovery": "EXTERNAL"
},
"title": "Wiesemann \u0026 Theis: XSS vulnerability in web interface of the Com-Server family",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-42786",
"datePublished": "2022-11-10T11:02:32.615Z",
"dateReserved": "2022-10-11T13:32:19.672Z",
"dateUpdated": "2025-04-29T14:56:50.373Z",
"requesterUserId": "a1e5283b-8f0d-401e-98b2-bc6219c0e8d1",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-42785 (GCVE-0-2022-42785)
Vulnerability from nvd – Published: 2022-11-10 11:01 – Updated: 2025-05-01 19:02
VLAI?
Title
Wiesemann & Theis: Authentication bypass in Com-Server family
Summary
Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.
Severity ?
9.8 (Critical)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wiesemann & Theis | Com-Server LC |
Affected:
1.0 , < 1.48
(semver)
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:19:04.510Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-42785",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-01T19:01:46.831217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-01T19:02:00.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Com-Server LC",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server PoE 3 x Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server 20mA",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server ++",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AT-Modem-Emulator",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server UL",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseFX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseLX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 1 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 4 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Industry",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed OEM",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Compact",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 1Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 4Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed PoE",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-11-07T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple W\u0026amp;T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request."
}
],
"value": "Multiple W\u0026T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T20:43:00.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/de/advisories/VDE-2022-043/"
}
],
"source": {
"advisory": "VDE-2022-043",
"defect": [
"CERT@VDE#64257"
],
"discovery": "EXTERNAL"
},
"title": "Wiesemann \u0026 Theis: Authentication bypass in Com-Server family",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-42785",
"datePublished": "2022-11-10T11:01:41.011Z",
"dateReserved": "2022-10-11T13:32:19.671Z",
"dateUpdated": "2025-05-01T19:02:00.365Z",
"requesterUserId": "a1e5283b-8f0d-401e-98b2-bc6219c0e8d1",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}