Riskcovery

CVE-2022-42787

Wiesemann & Theis: Small number space for allocating session id in Com-Server family

State
Published
Severity
8.8 High
Published
Nov 10, 2022
Updated
May 1, 2025
Reserved
Oct 11, 2022

Read the record on cve.org

Description

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCERTVDE

Weaknesses

  • CWE-330 Use of Insufficiently Random Values

Affected Products

ProductVersions
Com-Server LCWiesemann & Theis
  • 1.0 to before 1.48Affected
Com-Server PoE 3 x IsolatedWiesemann & Theis
  • 1.0 to before 1.48Affected
Com-Server 20mAWiesemann & Theis
  • 1.0 to before 1.48Affected
Com-Server ++Wiesemann & Theis
  • 1.0 to before 1.48Affected
AT-Modem-EmulatorWiesemann & Theis
  • 1.0 to before 1.48Affected
Com-Server ULWiesemann & Theis
  • 1.0 to before 1.48Affected
Com-Server Highspeed 100BaseFXWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed 100BaseLXWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed Office 1 PortWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed Office 4 PortWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed IndustryWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed OEMWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed CompactWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed IsolatedWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed 19" 1PortWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed 19" 4PortWiesemann & Theis
  • 1.0 to before 1.76Affected
Com-Server Highspeed PoEWiesemann & Theis
  • 1.0 to before 1.76Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.