CVE-2022-42785

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
Wiesemann & TheisCom-Server LC>= 1.0, < 1.48
Wiesemann & TheisCom-Server PoE 3 x Isolated>= 1.0, < 1.48
Wiesemann & TheisCom-Server 20mA>= 1.0, < 1.48
Wiesemann & TheisCom-Server ++>= 1.0, < 1.48
Wiesemann & TheisAT-Modem-Emulator>= 1.0, < 1.48
Wiesemann & TheisCom-Server UL>= 1.0, < 1.48
Wiesemann & TheisCom-Server Highspeed 100BaseFX>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed 100BaseLX>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed Office 1 Port>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed Office 4 Port>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed Industry>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed OEM>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed Compact>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed Isolated>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed 19" 1Port>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed 19" 4Port>= 1.0, < 1.76
Wiesemann & TheisCom-Server Highspeed PoE>= 1.0, < 1.76

References

Timeline

Published
Nov 15, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-427865.4Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scriptsCVE-2022-427878.8Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticatedCVE-2022-427885.5A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A maliciCVE-2022-427895.5An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOSCVE-2022-42796.1A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown funcCVE-2022-427905.5A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 anCVE-2022-427917.0A race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrarCVE-2022-427925.5This issue was addressed with improved data protection. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to read sensitive CVE-2022-427935.5An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 1CVE-2022-427958.8A memory consumption issue was addressed with improved memory handling. This issue is fixed in tvOS 16, iOS 16, macOS Ventura 13, watchOS 9.CVE-2022-427967.8This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.7 and iPadOS 15.7, macOS Ventura 13. An app may be aCVE-2022-427977.8An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileg
CVE-2022-42785: Critical severity, CVSS 9.8 | Vulnix