Log in Start free

Vulnerability · Published Nov 10, 2022 · Assigned by CERTVDE

CVE-2022-42787Wiesemann & Theis: Small number space for allocating session id in Com-Server family

High 8.8

In plain English

A high-severity weak randomness in AT-Modem-Emulator from Wiesemann & Theis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.8%top 43.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.

Affected products (as reported)

VendorProductVersions
Wiesemann & Theis Com-Server LC 1.0 – before 1.48
Wiesemann & Theis Com-Server PoE 3 x Isolated 1.0 – before 1.48
Wiesemann & Theis Com-Server 20mA 1.0 – before 1.48
Wiesemann & Theis Com-Server ++ 1.0 – before 1.48
Wiesemann & Theis AT-Modem-Emulator 1.0 – before 1.48
Wiesemann & Theis Com-Server UL 1.0 – before 1.48
Wiesemann & Theis Com-Server Highspeed 100BaseFX 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed 100BaseLX 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed Office 1 Port 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed Office 4 Port 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed Industry 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed OEM 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed Compact 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed Isolated 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed 19" 1Port 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed 19" 4Port 1.0 – before 1.76
Wiesemann & Theis Com-Server Highspeed PoE 1.0 – before 1.76

Weakness: CWE-330 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References