by Kastro
Paper/Archive/CVE-2022-42785

CVE-2022-42785

Wiesemann & Theis Com-Server LC — Wiesemann & Theis: Authentication bypass in Com-Server family

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.3.653 × 2013.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.

Affected

ProductAffectedFixed inSource
Com-Server LC1.0 – < 1.481.48CNA
Com-Server PoE 3 x Isolated1.0 – < 1.481.48CNA
Com-Server 20mA1.0 – < 1.481.48CNA
Com-Server ++1.0 – < 1.481.48CNA
AT-Modem-Emulator1.0 – < 1.481.48CNA
Com-Server UL1.0 – < 1.481.48CNA
Com-Server Highspeed 100BaseFX1.0 – < 1.761.76CNA
Com-Server Highspeed 100BaseLX1.0 – < 1.761.76CNA
Com-Server Highspeed Office 1 Port1.0 – < 1.761.76CNA
Com-Server Highspeed Office 4 Port1.0 – < 1.761.76CNA
Com-Server Highspeed Industry1.0 – < 1.761.76CNA
Com-Server Highspeed OEM1.0 – < 1.761.76CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcert.vde.com/de/advisories/VDE-2022-043