CVE-2022-42785: Wiesemann & Theis: Authentication bypass in Com-Server family
Published Nov 10, 2022
·Updated
Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.
Affected Software
68 affected components
Wut At-modem-emulator Firmware<1.48
Wut At-modem-emulator
Wut Com-server \+\+ Firmware<1.48
Wut Com-server \+\+
Wut Com-server 20ma Firmware<1.48
Wut Com-server 20ma
Wut Com-server Highspeed 100basefx Firmware<1.76
Wut Com-server Highspeed 100basefx
Wut Com-server Highspeed 100baselx Firmware<1.76
Wut Com-server Highspeed 100baselx
Wut Com-server Highspeed 19\" 1port Firmware<1.76
Wut Com-server Highspeed 19\" 1port
Wut Com-server Highspeed 19\" 4port Firmware<1.76
Wut Com-server Highspeed 19\" 4port
Wut Com-server Highspeed Compact Firmware<1.76
Wut Com-server Highspeed Compact
Wut Com-server Highspeed Industry Firmware<1.76
Wut Com-server Highspeed Industry
Wut Com-server Highspeed Isolated Firmware<1.76
Wut Com-server Highspeed Isolated
Wut Com-server Highspeed Oem Firmware<1.76
Wut Com-server Highspeed Oem
Wut Com-server Highspeed Office 1port Firmware<1.76
Wut Com-server Highspeed Office 1port
Wut Com-server Highspeed Office 4port Firmware<1.76
Wut Com-server Highspeed Office 4port
Wut Com-server Highspeed Poe Firmware<1.76
Wut Com-server Highspeed Poe
Wut Com-server Highspeed Lc Firmware<1.48
Wut Com-server Highspeed Lc
Wut Com-server Highspeed Ul Firmware<1.48
Wut Com-server Highspeed Ul
Wut Com-server Highspeed Poe 3x Isolated Firmware<1.48
Wut Com-server Highspeed Poe 3x Isolated
All of the following
Wut At-modem-emulator Firmware<1.48
Wut At-modem-emulator
All of the following
Wut Com-server \+\+ Firmware<1.48
Wut Com-server \+\+
All of the following
Wut Com-server 20ma Firmware<1.48
Wut Com-server 20ma
All of the following
Wut Com-server Highspeed 100basefx Firmware<1.76
Wut Com-server Highspeed 100basefx
All of the following
Wut Com-server Highspeed 100baselx Firmware<1.76
Wut Com-server Highspeed 100baselx
All of the following
Wut Com-server Highspeed 19\" 1port Firmware<1.76
Wut Com-server Highspeed 19\" 1port
All of the following
Wut Com-server Highspeed 19\" 4port Firmware<1.76
Wut Com-server Highspeed 19\" 4port
All of the following
Wut Com-server Highspeed Compact Firmware<1.76
Wut Com-server Highspeed Compact
All of the following
Wut Com-server Highspeed Industry Firmware<1.76
Wut Com-server Highspeed Industry
All of the following
Wut Com-server Highspeed Isolated Firmware<1.76
Wut Com-server Highspeed Isolated
All of the following
Wut Com-server Highspeed Oem Firmware<1.76
Wut Com-server Highspeed Oem
All of the following
Wut Com-server Highspeed Office 1port Firmware<1.76
Wut Com-server Highspeed Office 1port
All of the following
Wut Com-server Highspeed Office 4port Firmware<1.76
Wut Com-server Highspeed Office 4port
All of the following
Wut Com-server Highspeed Poe Firmware<1.76
Wut Com-server Highspeed Poe
All of the following
Wut Com-server Highspeed Lc Firmware<1.48
Wut Com-server Highspeed Lc
All of the following
Wut Com-server Highspeed Ul Firmware<1.48
Wut Com-server Highspeed Ul
All of the following
Wut Com-server Highspeed Poe 3x Isolated Firmware<1.48
Wut Com-server Highspeed Poe 3x Isolated
Event History
Nov 10, 2022
CVE Published
via MITRE·11:01 AM
Data Sourced
via MITRE·11:01 AM
DescriptionSeverityWeakness
Nov 15, 2022
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-42785.
2
What is the severity of CVE-2022-42785?
The severity of CVE-2022-42785 is critical, with a severity value of 9.8.
3
Which products are affected by CVE-2022-42785?
Multiple W&T products of the ComServer Series are affected.
4
How does CVE-2022-42785 work?
An unauthenticated remote attacker can bypass authentication by crafting a modified HTTP GET request and log in without knowledge of the password.
5
Is there a fix available for CVE-2022-42785?
Please refer to the advisory from VDE for information on available fixes.