Skip to content
OpenAdvisories
High VDE-2022-057 1 CVE

Wiesemann & Theis multiple products prone to web interface vulnerability

Published Dec 13, 2022 · Updated May 14, 2025 · Revision 2

Vendor: Wiesemann & Theis Product: Com-Server 20mA Product: Com-Server Highspeed 100BaseFX Product: Com-Server Highspeed 100BaseLX Product: Com-Server Highspeed 19" 1Port Product: Com-Server Highspeed 19" 4Port Product: Com-Server Highspeed Compact Product: Com-Server Highspeed Industry Product: Com-Server Highspeed Isolated Product: Com-Server Highspeed OEM Product: Com-Server Highspeed Office 1 Port Product: Com-Server Highspeed Office 4 Port Product: Com-Server Highspeed PoE Product: Com-Server LC Product: Com-Server PoE 3 x Isolated Product: Com-Server UL Product: Com-Server++

Summary

Multiple Wiesemann & Theis product families are affected by a vulnerability in the web interface. The device allows an unauthenticated attacker to get the session ID of a logged in user. He may then spoof his IP address to act as the logged in user.

Details

Impact
The attacker can set all settings and take over the device completely.

Remediation
Update Com-Server family to version 1.55 Update Com-Server Highspeed family to version 1.78 or higher

Vulnerabilities 1

  • High 8.0
    CVE-2022-4098

    Wiesemann & Theis: Multiple products prone to missing authentication through spoofing

    Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP sp…

    Wiesemann & Theis Com-Server 20mA Com-Server++ Com-Server UL

Revision history

  1. #2

    Fix: added distribution

  2. #1

    Initial revision.

References