CVE-2022-4098 - Wiesemann & Theis: Multiple products prone to missing authentication through spoofing

Back Back to CVE browser

HIGH

Wiesemann & Theis: Multiple products prone to missing authentication through spoofing

Published Dec 13, 2022

8.0

HIGH

CVSS 3.1

EPSS 0.35%

Description

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.

Affected products

Vendor Wiesemann & Theis Product Com-Server ++ Default
unaffected
Affected
- ≥ 0, < 1.55
Vendor Wiesemann & Theis Product Com-Server 20mA Default
unaffected
Affected
- ≥ 0, < 1.55
Vendor Wiesemann & Theis Product Com-Server Highspeed 100BaseFX Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed 100BaseLX Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed 19" 1Port Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed 19" 4Port Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed Compact Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed Industry Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed Isolated Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed OEM Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed Office 1 Port Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed Office 4 Port Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server Highspeed PoE Default
unaffected
Affected
- ≥ 0, < 1.78
Vendor Wiesemann & Theis Product Com-Server LC Default
unaffected
Affected
- ≥ 0, < 1.55
Vendor Wiesemann & Theis Product Com-Server PoE 3 x Isolated Default
unaffected
Affected
- ≥ 0, < 1.55
Vendor Wiesemann & Theis Product Com-Server UL Default
unaffected
Affected
- ≥ 0, < 1.55

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Wiesemann & Theis	Com-Server ++	unaffected	Affected ≥ 0, < 1.55
Wiesemann & Theis	Com-Server 20mA	unaffected	Affected ≥ 0, < 1.55
Wiesemann & Theis	Com-Server Highspeed 100BaseFX	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed 100BaseLX	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed 19" 1Port	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed 19" 4Port	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed Compact	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed Industry	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed Isolated	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed OEM	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed Office 1 Port	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed Office 4 Port	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server Highspeed PoE	unaffected	Affected ≥ 0, < 1.78
Wiesemann & Theis	Com-Server LC	unaffected	Affected ≥ 0, < 1.55
Wiesemann & Theis	Com-Server PoE 3 x Isolated	unaffected	Affected ≥ 0, < 1.55
Wiesemann & Theis	Com-Server UL	unaffected	Affected ≥ 0, < 1.55