CVE-2022-42787: Wiesemann & Theis: Small number space for allocating session id in Com-Server family

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2022-42787.

Q: What is the severity of CVE-2022-42787?

CVE-2022-42787 has a severity rating of 8.8, which is considered high.

Q: Which products are affected by CVE-2022-42787?

Multiple W&T products of the Comserver Series are affected by CVE-2022-42787.

Q: How does the vulnerability in W&T Comserver Series products work?

The vulnerability in W&T Comserver Series products allows an unauthenticated remote attacker to brute force session IDs and gain unauthorized access to user accounts on the device.

Q: Is there a fix available for CVE-2022-42787?

The fix for CVE-2022-42787 is not specified in the provided information. It is recommended to follow the guidance from the official reference link for any available fix or mitigation.

Published Nov 10, 2022

Updated

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.

Affected Software

68 affected components

Wut At-modem-emulator Firmware<1.48

Wut At-modem-emulator

Wut Com-server \+\+ Firmware<1.48

Wut Com-server \+\+

Wut Com-server 20ma Firmware<1.48

Wut Com-server 20ma

Wut Com-server Highspeed 100basefx Firmware<1.76

Wut Com-server Highspeed 100basefx

Wut Com-server Highspeed 100baselx Firmware<1.76

Wut Com-server Highspeed 100baselx

Wut Com-server Highspeed 19\" 1port Firmware<1.76

Wut Com-server Highspeed 19\" 1port

Wut Com-server Highspeed 19\" 4port Firmware<1.76

Wut Com-server Highspeed 19\" 4port

Wut Com-server Highspeed Compact Firmware<1.76

Wut Com-server Highspeed Compact

Wut Com-server Highspeed Industry Firmware<1.76

Wut Com-server Highspeed Industry

Wut Com-server Highspeed Isolated Firmware<1.76

Wut Com-server Highspeed Isolated

Wut Com-server Highspeed Oem Firmware<1.76

Wut Com-server Highspeed Oem

Wut Com-server Highspeed Office 1port Firmware<1.76

Wut Com-server Highspeed Office 1port

Wut Com-server Highspeed Office 4port Firmware<1.76

Wut Com-server Highspeed Office 4port

Wut Com-server Highspeed Poe Firmware<1.76

Wut Com-server Highspeed Poe

Wut Com-server Highspeed Lc Firmware<1.48

Wut Com-server Highspeed Lc

Wut Com-server Highspeed Ul Firmware<1.48

Wut Com-server Highspeed Ul

Wut Com-server Highspeed Poe 3x Isolated Firmware<1.48

Wut Com-server Highspeed Poe 3x Isolated

All of the following

Wut At-modem-emulator Firmware<1.48

Wut At-modem-emulator

All of the following

Wut Com-server \+\+ Firmware<1.48

Wut Com-server \+\+

All of the following

Wut Com-server 20ma Firmware<1.48

Wut Com-server 20ma

All of the following

Wut Com-server Highspeed 100basefx Firmware<1.76

Wut Com-server Highspeed 100basefx

All of the following

Wut Com-server Highspeed 100baselx Firmware<1.76

Wut Com-server Highspeed 100baselx

All of the following

Wut Com-server Highspeed 19\" 1port Firmware<1.76

Wut Com-server Highspeed 19\" 1port

All of the following

Wut Com-server Highspeed 19\" 4port Firmware<1.76

Wut Com-server Highspeed 19\" 4port

All of the following

Wut Com-server Highspeed Compact Firmware<1.76

Wut Com-server Highspeed Compact

All of the following

Wut Com-server Highspeed Industry Firmware<1.76

Wut Com-server Highspeed Industry

All of the following

Wut Com-server Highspeed Isolated Firmware<1.76

Wut Com-server Highspeed Isolated

All of the following

Wut Com-server Highspeed Oem Firmware<1.76

Wut Com-server Highspeed Oem

All of the following

Wut Com-server Highspeed Office 1port Firmware<1.76

Wut Com-server Highspeed Office 1port

All of the following

Wut Com-server Highspeed Office 4port Firmware<1.76

Wut Com-server Highspeed Office 4port

All of the following

Wut Com-server Highspeed Poe Firmware<1.76

Wut Com-server Highspeed Poe

All of the following

Wut Com-server Highspeed Lc Firmware<1.48

Wut Com-server Highspeed Lc

All of the following

Wut Com-server Highspeed Ul Firmware<1.48

Wut Com-server Highspeed Ul

All of the following

Wut Com-server Highspeed Poe 3x Isolated Firmware<1.48

Wut Com-server Highspeed Poe 3x Isolated

Event History

Nov 10, 2022

CVE Published

via MITRE·11:06 AM

Data Sourced

via MITRE·11:06 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2022-42787.

What is the severity of CVE-2022-42787?

CVE-2022-42787 has a severity rating of 8.8, which is considered high.

Which products are affected by CVE-2022-42787?

Multiple W&T products of the Comserver Series are affected by CVE-2022-42787.

How does the vulnerability in W&T Comserver Series products work?

The vulnerability in W&T Comserver Series products allows an unauthenticated remote attacker to brute force session IDs and gain unauthorized access to user accounts on the device.

Is there a fix available for CVE-2022-42787?

The fix for CVE-2022-42787 is not specified in the provided information. It is recommended to follow the guidance from the official reference link for any available fix or mitigation.

CVE-2022-42787: Wiesemann & Theis: Small number space for allocating session id in Com-Server family

Affected Software

Event History

Frequently Asked Questions

What is the vulnerability ID for this issue?

What is the severity of CVE-2022-42787?

Which products are affected by CVE-2022-42787?

How does the vulnerability in W&T Comserver Series products work?

Is there a fix available for CVE-2022-42787?

Company

Resources

Contact