CVE-2022-42786: medium-severity vulnerability in Wiesemann & Theis AT-Modem-Emulator
Wiesemann & Theis: XSS vulnerability in web interface of the Com-Server family
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.5%
Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Wiesemann & Theis · AT-Modem-EmulatorWiesemann & Theis · Com-Server ++Wiesemann & Theis · Com-Server 20mAWiesemann & Theis · Com-Server Highspeed 100BaseFXWiesemann & Theis · Com-Server Highspeed 100BaseLXWiesemann & Theis · Com-Server Highspeed 19" 1PortWiesemann & Theis · Com-Server Highspeed 19" 4PortWiesemann & Theis · Com-Server Highspeed CompactWiesemann & Theis · Com-Server Highspeed IndustryWiesemann & Theis · Com-Server Highspeed IsolatedWiesemann & Theis · Com-Server Highspeed OEMWiesemann & Theis · Com-Server Highspeed Office 1 PortWiesemann & Theis · Com-Server Highspeed Office 4 PortWiesemann & Theis · Com-Server Highspeed PoEWiesemann & Theis · Com-Server LCWiesemann & Theis · Com-Server PoE 3 x IsolatedWiesemann & Theis · Com-Server ULRelated CVEs — Wiesemann & Theis AT-Modem-Emulator
In the same product, most dangerous first.
CVE-2022-42785CRITICALWiesemann & Theis: Authentication bypass in Com-Server familyEPSS 1.1%CVE-2022-42787HIGHWiesemann & Theis: Small number space for allocating session id in Com-Server familyEPSS 0.8%CVE-2025-3200CRITICALCom-Server Exposed via Weak TLSEPSS 0.4%CVE-2022-4098HIGHWiesemann & Theis: Multiple products prone to missing authentication through spoofingEPSS 0.3%