CVE-2022-4098
13.12.2022, 08:15
Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.Enginsight
| Vendor | Product | Version |
|---|---|---|
| wut | com-server_\+\+_firmware | 𝑥 < 1.55 |
| wut | com-server_20ma_firmware | 𝑥 < 1.55 |
| wut | com-server_highspeed_100basefx_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_100baselx_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_19\"_1port_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_19\"_4port_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_compact_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_industry_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_isolated_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_oem_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_office_1port_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_office_4port_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_poe_firmware | 𝑥 < 1.78 |
| wut | com-server_highspeed_lc_firmware | 𝑥 < 1.55 |
| wut | com-server_highspeed_poe_3x_isolated_firmware | 𝑥 < 1.55 |
| wut | com-server_highspeed_ul_firmware | 𝑥 < 1.55 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration