Skip to content
OpenAdvisories
Critical VDE-2022-043 3 CVEs

Wiesemann & Theis: Multiple Vulnerabilities in the Com-Server Family

Published Nov 7, 2022 · Updated Nov 7, 2022

Vendor: Wiesemann & Theis Product: 1.76 Product: AT-Modem-Emulator Product: Com-Server 20mA Product: Com-Server Highspeed 100BaseFX Product: Com-Server Highspeed 100BaseLX Product: Com-Server Highspeed 19" 1Port Product: Com-Server Highspeed 19" 4Port Product: Com-Server Highspeed Compact Product: Com-Server Highspeed Industry Product: Com-Server Highspeed Isolated Product: Com-Server Highspeed OEM Product: Com-Server Highspeed Office 1 Port Product: Com-Server Highspeed Office 4 Port Product: Com-Server Highspeed PoE Product: Com-Server LC Product: Com-Server PoE 3 x Isolated Product: Com-Server UL Product: Com-Server++

Summary

Multiple Wiesemann & Theis product families are affected by multiple vulnerabilities in the web interface.

Details

Impact
See CVEs for further details.

Remediation
- Update Com-Server Family to version 1.48 or higher.

- Update the Com-Server Highspeed Family to version 1.76 or higher.

Vulnerabilities 3

  • Critical 9.8
    CVE-2022-42785

    Wiesemann & Theis: Authentication bypass in Com-Server family

    Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.

    Wiesemann & Theis Com-Server 20mA Com-Server++ Com-Server UL
  • High 8.8
    CVE-2022-42787

    Wiesemann & Theis: Small number space for allocating session id in Com-Server family

    Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user need…

    Wiesemann & Theis Com-Server UL Com-Server 20mA Com-Server++
  • Medium 5.4
    CVE-2022-42786

    Wiesemann & Theis: XSS vulnerability in web interface of the Com-Server family

    Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage

    Wiesemann & Theis Com-Server 20mA Com-Server++ Com-Server UL

Revision history

  1. #1

    Initial revision.

References