CVE-2022-42786

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Wiesemann & Theis	Com-Server LC	>= 1.0, < 1.48
Wiesemann & Theis	Com-Server PoE 3 x Isolated	>= 1.0, < 1.48
Wiesemann & Theis	Com-Server 20mA	>= 1.0, < 1.48
Wiesemann & Theis	Com-Server ++	>= 1.0, < 1.48
Wiesemann & Theis	AT-Modem-Emulator	>= 1.0, < 1.48
Wiesemann & Theis	Com-Server UL	>= 1.0, < 1.48
Wiesemann & Theis	Com-Server Highspeed 100BaseFX	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed 100BaseLX	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed Office 1 Port	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed Office 4 Port	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed Industry	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed OEM	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed Compact	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed Isolated	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed 19" 1Port	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed 19" 4Port	>= 1.0, < 1.76
Wiesemann & Theis	Com-Server Highspeed PoE	>= 1.0, < 1.76

References

https://cert.vde.com/de/advisories/VDE-2022-043/Third Party Advisory
https://cert.vde.com/de/advisories/VDE-2022-043/Third Party Advisory

Timeline

Published: Nov 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-427878.8Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated CVE-2022-427885.5A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A malici CVE-2022-427895.5An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS CVE-2022-42796.1A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown func CVE-2022-427905.5A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 an CVE-2022-427917.0A race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrar CVE-2022-427925.5This issue was addressed with improved data protection. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to read sensitive CVE-2022-427935.5An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 1 CVE-2022-427958.8A memory consumption issue was addressed with improved memory handling. This issue is fixed in tvOS 16, iOS 16, macOS Ventura 13, watchOS 9.CVE-2022-427967.8This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.7 and iPadOS 15.7, macOS Ventura 13. An app may be a CVE-2022-427977.8An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileg CVE-2022-427985.5The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, wat