Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2022-42787

Wiesemann & Theis: Small number space for allocating session id in Com-Server family

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Wiesemann & Theis Com-Server LC

Default version status: unaffected

  • 1.0 to < 1.48affected

Wiesemann & Theis Com-Server PoE 3 x Isolated

Default version status: unaffected

  • 1.0 to < 1.48affected

Wiesemann & Theis Com-Server 20mA

Default version status: unaffected

  • 1.0 to < 1.48affected

Wiesemann & Theis Com-Server ++

Default version status: unaffected

  • 1.0 to < 1.48affected

Wiesemann & Theis AT-Modem-Emulator

Default version status: unaffected

  • 1.0 to < 1.48affected

Wiesemann & Theis Com-Server UL

Default version status: unaffected

  • 1.0 to < 1.48affected

Wiesemann & Theis Com-Server Highspeed 100BaseFX

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed 100BaseLX

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed Office 1 Port

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed Office 4 Port

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed Industry

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed OEM

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed Compact

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed Isolated

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed 19" 1Port

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed 19" 4Port

Default version status: unaffected

  • 1.0 to < 1.76affected

Wiesemann & Theis Com-Server Highspeed PoE

Default version status: unaffected

  • 1.0 to < 1.76affected

References