CVE-2022-4098: falha de alta gravidade em Wiesemann & Theis Com-Server ++
Wiesemann & Theis: Multiple products prone to missing authentication through spoofing
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8epss 0.3%
Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Wiesemann & Theis · Com-Server ++Wiesemann & Theis · Com-Server 20mAWiesemann & Theis · Com-Server Highspeed 100BaseFXWiesemann & Theis · Com-Server Highspeed 100BaseLXWiesemann & Theis · Com-Server Highspeed 19" 1PortWiesemann & Theis · Com-Server Highspeed 19" 4PortWiesemann & Theis · Com-Server Highspeed CompactWiesemann & Theis · Com-Server Highspeed IndustryWiesemann & Theis · Com-Server Highspeed IsolatedWiesemann & Theis · Com-Server Highspeed OEMWiesemann & Theis · Com-Server Highspeed Office 1 PortWiesemann & Theis · Com-Server Highspeed Office 4 PortWiesemann & Theis · Com-Server Highspeed PoEWiesemann & Theis · Com-Server LCWiesemann & Theis · Com-Server PoE 3 x IsolatedWiesemann & Theis · Com-Server ULCVEs relacionadas — Wiesemann & Theis Com-Server ++
No mesmo produto, das mais perigosas para as menos.
CVE-2022-42785CRITICALWiesemann & Theis: Authentication bypass in Com-Server familyEPSS 1.1%CVE-2022-42787HIGHWiesemann & Theis: Small number space for allocating session id in Com-Server familyEPSS 0.8%CVE-2022-42786MEDIUMWiesemann & Theis: XSS vulnerability in web interface of the Com-Server familyEPSS 0.5%CVE-2025-3200CRITICALCom-Server Exposed via Weak TLSEPSS 0.4%