Vulnerability in Wiesemann & Theis At-Modem-Emulator
CVE-2022-42787
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: +0.000
Affected products
- Wiesemann & Theis At-Modem-Emulator — versions 1.0
- Wiesemann & Theis Com-Server ++ — versions 1.0
- Wiesemann & Theis Com-Server 20ma — versions 1.0
- Wiesemann & Theis Com-Server Highspeed 100basefx — versions 1.0
- Wiesemann & Theis Com-Server Highspeed 100baselx — versions 1.0
- Wiesemann & Theis Com-Server Highspeed 19" 1port — versions 1.0
- Wiesemann & Theis Com-Server Highspeed 19" 4port — versions 1.0
- Wiesemann & Theis Com-Server Highspeed Compact — versions 1.0
- Wiesemann & Theis Com-Server Highspeed Industry — versions 1.0
- Wiesemann & Theis Com-Server Highspeed Isolated — versions 1.0
Weakness classification (CWE)
References
- cert.vde.com/de/advisories/VDE-2022-043 (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-42787?
- CVE-2022-42787 is a high-severity vulnerability in Wiesemann & Theis At-Modem-Emulator, classified under Use of Insufficiently Random Values. CVSS score: 8.8/10. Published 2022-11-10.
- How severe is CVE-2022-42787?
- High severity. CVSS v3 base score is 8.8 out of 10.