CVE-2022-42786 — Wiesemann & Theis: XSS vulnerability in web interface of the Com-Server family

Description (CNA)

Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage

Affected (CNA)

Vendor / product	Versions
Wiesemann & Theis / Com-Server LC	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server PoE 3 x Isolated	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server 20mA	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server ++	affected 1.0 before 1.48
Wiesemann & Theis / AT-Modem-Emulator	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server UL	affected 1.0 before 1.48
Wiesemann & Theis / Com-Server Highspeed 100BaseFX	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed 100BaseLX	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Office 1 Port	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Office 4 Port	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Industry	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed OEM	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Compact	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed Isolated	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed 19" 1Port	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed 19" 4Port	affected 1.0 before 1.76
Wiesemann & Theis / Com-Server Highspeed PoE	affected 1.0 before 1.76

CWE

CWE-79

References

https://cert.vde.com/de/advisories/VDE-2022-043/

ADP enrichment

CVE

No English description supplied.

https://cert.vde.com/de/advisories/VDE-2022-043/

CISA-ADP

No English description supplied.

No references supplied.