Lucene search

CERTVDECVELIST:CVE-2022-42785

HistoryNov 10, 2022 - 11:01 a.m.

CVE-2022-42785 Wiesemann & Theis: Authentication bypass in Com-Server family

2022-11-1011:01:41

CWE-306

CERTVDE

www.cve.org

wiesemann & theis

com-server

authentication bypass

cve-2022-42785

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.2%

JSON

Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server LC",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.48",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server PoE 3 x Isolated",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.48",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server 20mA",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.48",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server ++",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.48",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "AT-Modem-Emulator",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.48",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server UL",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.48",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed 100BaseFX",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed 100BaseLX",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed Office 1 Port",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed Office 4 Port",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed Industry",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed OEM",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed Compact",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed Isolated",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed 19\" 1Port",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed 19\" 4Port",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Com-Server Highspeed PoE",
    "vendor": "Wiesemann & Theis",
    "versions": [
      {
        "lessThan": "1.76",
        "status": "affected",
        "version": "1.0",
        "versionType": "semver"
      }
    ]
  }
]

References

cert.vde.com/de/advisories/VDE-2022-043/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.2%

JSON

Related for CVELIST:CVE-2022-42785