CVE-2022-4098

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

VendorProductVersions
Wiesemann & TheisCom-Server ++< 1.55
Wiesemann & TheisCom-Server 20mA< 1.55
Wiesemann & TheisCom-Server Highspeed 100BaseFX< 1.78
Wiesemann & TheisCom-Server Highspeed 100BaseLX< 1.78
Wiesemann & TheisCom-Server Highspeed 19" 1Port< 1.78
Wiesemann & TheisCom-Server Highspeed 19" 4Port< 1.78
Wiesemann & TheisCom-Server Highspeed Compact< 1.78
Wiesemann & TheisCom-Server Highspeed Industry< 1.78
Wiesemann & TheisCom-Server Highspeed Isolated< 1.78
Wiesemann & TheisCom-Server Highspeed OEM< 1.78
Wiesemann & TheisCom-Server Highspeed Office 1 Port< 1.78
Wiesemann & TheisCom-Server Highspeed Office 4 Port< 1.78
Wiesemann & TheisCom-Server Highspeed PoE< 1.78
Wiesemann & TheisCom-Server LC< 1.55
Wiesemann & TheisCom-Server PoE 3 x Isolated< 1.55
Wiesemann & TheisCom-Server UL< 1.55

References

Timeline

Published
Dec 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-409809.1A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with accCVE-2022-4098110.0All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advanCVE-2022-409826.5Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) ProcessoCVE-2022-409838.8An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can triCVE-2022-409849.8Stack-based buffer overflow in WTViewerE series WTViewerE 761941 from 1.31 to 1.61 and WTViewerEfree from 1.01 to 1.52 allows an attacker toCVE-2022-409859.8Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210CVE-2022-409869.8Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210CVE-2022-409879.8Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210CVE-2022-409889.8Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210CVE-2022-409899.8Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210CVE-2022-40999.8The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statementsCVE-2022-409909.8Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210