CVE-2022-42787: high-severity vulnerability in Wiesemann & Theis AT-Modem-Emulator
Wiesemann & Theis: Small number space for allocating session id in Com-Server family
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.8%
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Wiesemann & Theis · AT-Modem-EmulatorWiesemann & Theis · Com-Server ++Wiesemann & Theis · Com-Server 20mAWiesemann & Theis · Com-Server Highspeed 100BaseFXWiesemann & Theis · Com-Server Highspeed 100BaseLXWiesemann & Theis · Com-Server Highspeed 19" 1PortWiesemann & Theis · Com-Server Highspeed 19" 4PortWiesemann & Theis · Com-Server Highspeed CompactWiesemann & Theis · Com-Server Highspeed IndustryWiesemann & Theis · Com-Server Highspeed IsolatedWiesemann & Theis · Com-Server Highspeed OEMWiesemann & Theis · Com-Server Highspeed Office 1 PortWiesemann & Theis · Com-Server Highspeed Office 4 PortWiesemann & Theis · Com-Server Highspeed PoEWiesemann & Theis · Com-Server LCWiesemann & Theis · Com-Server PoE 3 x IsolatedWiesemann & Theis · Com-Server ULRelated CVEs — Wiesemann & Theis AT-Modem-Emulator
In the same product, most dangerous first.
CVE-2022-42785CRITICALWiesemann & Theis: Authentication bypass in Com-Server familyEPSS 1.1%CVE-2022-42786MEDIUMWiesemann & Theis: XSS vulnerability in web interface of the Com-Server familyEPSS 0.5%CVE-2025-3200CRITICALCom-Server Exposed via Weak TLSEPSS 0.4%CVE-2022-4098HIGHWiesemann & Theis: Multiple products prone to missing authentication through spoofingEPSS 0.3%