Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2022-4098

Wiesemann & Theis: Multiple products prone to missing authentication through spoofing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Wiesemann & Theis Com-Server ++

Default version status: unaffected

  • 0 to < 1.55affected

Wiesemann & Theis Com-Server 20mA

Default version status: unaffected

  • 0 to < 1.55affected

Wiesemann & Theis Com-Server Highspeed 100BaseFX

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed 100BaseLX

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed 19" 1Port

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed 19" 4Port

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed Compact

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed Industry

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed Isolated

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed OEM

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed Office 1 Port

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed Office 4 Port

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server Highspeed PoE

Default version status: unaffected

  • 0 to < 1.78affected

Wiesemann & Theis Com-Server LC

Default version status: unaffected

  • 0 to < 1.55affected

Wiesemann & Theis Com-Server PoE 3 x Isolated

Default version status: unaffected

  • 0 to < 1.55affected

Wiesemann & Theis Com-Server UL

Default version status: unaffected

  • 0 to < 1.55affected

References