CVE-2022-4098: high-severity vulnerability in Wiesemann & Theis Com-Server ++
Wiesemann & Theis: Multiple products prone to missing authentication through spoofing
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8epss 0.3%
Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Wiesemann & Theis · Com-Server ++Wiesemann & Theis · Com-Server 20mAWiesemann & Theis · Com-Server Highspeed 100BaseFXWiesemann & Theis · Com-Server Highspeed 100BaseLXWiesemann & Theis · Com-Server Highspeed 19" 1PortWiesemann & Theis · Com-Server Highspeed 19" 4PortWiesemann & Theis · Com-Server Highspeed CompactWiesemann & Theis · Com-Server Highspeed IndustryWiesemann & Theis · Com-Server Highspeed IsolatedWiesemann & Theis · Com-Server Highspeed OEMWiesemann & Theis · Com-Server Highspeed Office 1 PortWiesemann & Theis · Com-Server Highspeed Office 4 PortWiesemann & Theis · Com-Server Highspeed PoEWiesemann & Theis · Com-Server LCWiesemann & Theis · Com-Server PoE 3 x IsolatedWiesemann & Theis · Com-Server ULRelated CVEs — Wiesemann & Theis Com-Server ++
In the same product, most dangerous first.
CVE-2022-42785CRITICALWiesemann & Theis: Authentication bypass in Com-Server familyEPSS 1.1%CVE-2022-42787HIGHWiesemann & Theis: Small number space for allocating session id in Com-Server familyEPSS 0.8%CVE-2022-42786MEDIUMWiesemann & Theis: XSS vulnerability in web interface of the Com-Server familyEPSS 0.5%CVE-2025-3200CRITICALCom-Server Exposed via Weak TLSEPSS 0.4%