Description
Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wiesemann & Theis | Com-Server LC | 1.0 – < 1.48 | 1.48 |
| Wiesemann & Theis | Com-Server PoE 3 x Isolated | 1.0 – < 1.48 | 1.48 |
| Wiesemann & Theis | Com-Server 20mA | 1.0 – < 1.48 | 1.48 |
| Wiesemann & Theis | Com-Server ++ | 1.0 – < 1.48 | 1.48 |
| Wiesemann & Theis | AT-Modem-Emulator | 1.0 – < 1.48 | 1.48 |
| Wiesemann & Theis | Com-Server UL | 1.0 – < 1.48 | 1.48 |
| Wiesemann & Theis | Com-Server Highspeed 100BaseFX | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed 100BaseLX | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed Office 1 Port | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed Office 4 Port | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed Industry | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed OEM | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed Compact | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed Isolated | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed 19" 1Port | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed 19" 4Port | 1.0 – < 1.76 | 1.76 |
| Wiesemann & Theis | Com-Server Highspeed PoE | 1.0 – < 1.76 | 1.76 |
Advisories 1
- VDE-2022-043 Wiesemann & Theis: Multiple Vulnerabilities in the Com-Server Family CERT@VDE · Nov 7, 2022