CVE-2022-42787: falha de alta gravidade em Wiesemann & Theis AT-Modem-Emulator
Wiesemann & Theis: Small number space for allocating session id in Com-Server family
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.8%
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Wiesemann & Theis · AT-Modem-EmulatorWiesemann & Theis · Com-Server ++Wiesemann & Theis · Com-Server 20mAWiesemann & Theis · Com-Server Highspeed 100BaseFXWiesemann & Theis · Com-Server Highspeed 100BaseLXWiesemann & Theis · Com-Server Highspeed 19" 1PortWiesemann & Theis · Com-Server Highspeed 19" 4PortWiesemann & Theis · Com-Server Highspeed CompactWiesemann & Theis · Com-Server Highspeed IndustryWiesemann & Theis · Com-Server Highspeed IsolatedWiesemann & Theis · Com-Server Highspeed OEMWiesemann & Theis · Com-Server Highspeed Office 1 PortWiesemann & Theis · Com-Server Highspeed Office 4 PortWiesemann & Theis · Com-Server Highspeed PoEWiesemann & Theis · Com-Server LCWiesemann & Theis · Com-Server PoE 3 x IsolatedWiesemann & Theis · Com-Server ULCVEs relacionadas — Wiesemann & Theis AT-Modem-Emulator
No mesmo produto, das mais perigosas para as menos.
CVE-2022-42785CRITICALWiesemann & Theis: Authentication bypass in Com-Server familyEPSS 1.1%CVE-2022-42786MEDIUMWiesemann & Theis: XSS vulnerability in web interface of the Com-Server familyEPSS 0.5%CVE-2025-3200CRITICALCom-Server Exposed via Weak TLSEPSS 0.4%CVE-2022-4098HIGHWiesemann & Theis: Multiple products prone to missing authentication through spoofingEPSS 0.3%