Vulnerability in Wiesemann & Theis At-Modem-Emulator
CVE-2022-42787
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
EPSS: 0.007 (50.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Wiesemann & Theis At-modem-emulator — versions 1.0
- Wiesemann & Theis Com-server ++ — versions 1.0
- Wiesemann & Theis Com-server 20ma — versions 1.0
- Wiesemann & Theis Com-server Highspeed 100basefx — versions 1.0
- Wiesemann & Theis Com-server Highspeed 100baselx — versions 1.0
- Wiesemann & Theis Com-server Highspeed 19" 1port — versions 1.0
- Wiesemann & Theis Com-server Highspeed 19" 4port — versions 1.0
- Wiesemann & Theis Com-server Highspeed Compact — versions 1.0
- Wiesemann & Theis Com-server Highspeed Industry — versions 1.0
- Wiesemann & Theis Com-server Highspeed Isolated — versions 1.0
Weakness classification (CWE)
References
- info@cert.vde.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-42787?
- CVE-2022-42787 is a high-severity vulnerability in Wiesemann & Theis At-Modem-Emulator, classified under Use of Insufficiently Random Values. CVSS score: 8.8/10. Published 2022-11-10.
- How severe is CVE-2022-42787?
- High severity. CVSS v3 base score is 8.8 out of 10.