Action not permitted
Modal body text goes here.
Modal Title
Modal Body
GHSA-QGC9-3M4W-R9W2
Vulnerability from github – Published: 2022-11-10 19:01 – Updated: 2022-11-15 19:00
VLAI?
Details
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. An unathenticated remote attacker can brute force the session id and gets access to an account on the the device.
Severity ?
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-42787"
],
"database_specific": {
"cwe_ids": [
"CWE-330"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-10T12:15:00Z",
"severity": "CRITICAL"
},
"details": "Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. An unathenticated remote attacker can brute force the session id and gets access to an account on the the device.",
"id": "GHSA-qgc9-3m4w-r9w2",
"modified": "2022-11-15T19:00:52Z",
"published": "2022-11-10T19:01:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42787"
},
{
"type": "WEB",
"url": "https://cert.vde.com/de/advisories/VDE-2022-043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
CVE-2022-42787 (GCVE-0-2022-42787)
Vulnerability from cvelistv5 – Published: 2022-11-10 11:06 – Updated: 2025-05-01 19:01
VLAI?
EPSS
Title
Wiesemann & Theis: Small number space for allocating session id in Com-Server family
Summary
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
Severity ?
8.8 (High)
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T13:19:04.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert.vde.com/de/advisories/VDE-2022-043"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-42787",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-01T19:01:02.435905Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-01T19:01:20.740Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Com-Server LC",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server PoE 3 x Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server 20mA",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server ++",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "AT-Modem-Emulator",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server UL",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.48",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseFX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 100BaseLX",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 1 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Office 4 Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Industry",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed OEM",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Compact",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed Isolated",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 1Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed 19\" 4Port",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Com-Server Highspeed PoE",
"vendor": "Wiesemann \u0026 Theis",
"versions": [
{
"lessThan": "1.76",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2022-11-07T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Multiple W\u0026amp;T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required."
}
],
"value": "Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required."
}
],
"impacts": [
{
"capecId": "CAPEC-112",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-112 Brute Force"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330 Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-01T13:56:46.185Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://cert.vde.com/de/advisories/VDE-2022-043"
}
],
"source": {
"advisory": "VDE-2022-043",
"defect": [
"CERT@VDE#64257"
],
"discovery": "EXTERNAL"
},
"title": "Wiesemann \u0026 Theis: Small number space for allocating session id in Com-Server family",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2022-42787",
"datePublished": "2022-11-10T11:06:20.856Z",
"dateReserved": "2022-10-11T13:32:19.672Z",
"dateUpdated": "2025-05-01T19:01:20.740Z",
"requesterUserId": "a1e5283b-8f0d-401e-98b2-bc6219c0e8d1",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…