CVE-2022-42787: Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker…

PriorityP344high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

0.73%

49.8th percentile

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.

Affected

34 ranges· showing 25

Vendor	Product	Version range	Fixed in
wiesemann_theis	at-modem-emulator	>= 1.0 < 1.48	1.48
wiesemann_theis	com-server	>= 1.0 < 1.48	1.48
wiesemann_theis	com-server_20ma	>= 1.0 < 1.48	1.48
wiesemann_theis	com-server_highspeed_100basefx	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_100baselx	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_19_1port	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_19_4port	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_compact	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_industry	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_isolated	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_oem	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_office_1_port	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_office_4_port	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_highspeed_poe	>= 1.0 < 1.76	1.76
wiesemann_theis	com-server_lc	>= 1.0 < 1.48	1.48
wiesemann_theis	com-server_poe_3_x_isolated	>= 1.0 < 1.48	1.48
wiesemann_theis	com-server_ul	>= 1.0 < 1.48	1.48
wut	at-modem-emulator_firmware	< 1.48	1.48
wut	com-server_+_+_firmware	< 1.48	1.48
wut	com-server_20ma_firmware	< 1.48	1.48
wut	com-server_highspeed_100basefx_firmware	< 1.76	1.76
wut	com-server_highspeed_100baselx_firmware	< 1.76	1.76
wut	com-server_highspeed_19_1port_firmware	< 1.76	1.76
wut	com-server_highspeed_19_4port_firmware	< 1.76	1.76
wut	com-server_highspeed_compact_firmware	< 1.76	1.76

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.