CVE-2022-42785 — Wiesemann & Theis: Authentication bypass in Com-Server family

Description (CNA)

Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.

Affected (CNA)

Vendor / product	Versions
Wiesemann & Theis / Com-Server LC	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server PoE 3 x Isolated	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server 20mA	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server ++	affected 1.0 before 1.48
Wiesemann & Theis / AT-Modem-Emulator	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server UL	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server Highspeed 100BaseFX	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed 100BaseLX	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Office 1 Port	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Office 4 Port	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Industry	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed OEM	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Compact	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Isolated	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed 19" 1Port	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed 19" 4Port	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed PoE	affected 1.0 before 1.76

CWE

CWE-306

References

https://cert.vde.com/de/advisories/VDE-2022-043/

ADP enrichment

CVE

No English description supplied.

https://cert.vde.com/de/advisories/VDE-2022-043/

CISA-ADP

No English description supplied.

No references supplied.