{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "Multiple Wiesemann & Theis product families are affected by multiple vulnerabilities in the web interface.", "title": "Summary" }, { "category": "description", "text": "See CVEs for further details.", "title": "Impact" }, { "category": "description", "text": "- Update Com-Server Family to version 1.48 or higher.\n\n- Update the Com-Server Highspeed Family to version 1.76 or higher.", "title": "Remediation" } ], "publisher": { "category": "vendor", "contact_details": "security@wut.de", "name": "Wiesemann & Theis GmbH", "namespace": "https://www.wut.de" }, "references": [ { "category": "external", "summary": "CERT@VDE Security Advisories for Wiesemann & Theis GmbH", "url": "https://certvde.com/en/advisories/vendor/wut/" }, { "category": "self", "summary": "VDE-2022-043: Wiesemann & Theis: Multiple Vulnerabilities in the Com-Server Family - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-043/" }, { "category": "self", "summary": "VDE-2022-043: Wiesemann & Theis: Multiple Vulnerabilities in the Com-Server Family - CSAF", "url": "https://wut.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-043.json" } ], "title": "Wiesemann & Theis: Multiple Vulnerabilities in the Com-Server Family", "tracking": { "aliases": [ "VDE-2022-043" ], "current_release_date": "2022-11-07T12:14:00.000Z", "generator": { "date": "2025-03-31T13:58:09.183Z", "engine": { "name": "Secvisogram", "version": "2.5.22" } }, "id": "VDE-2022-043", "initial_release_date": "2022-11-07T11:43:00.000Z", "revision_history": [ { "date": "2022-11-07T12:14:00.000Z", "number": "1", "summary": "Initial revision." } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "<1.48", "product": { "name": "AT-Modem-Emulator <1.48", "product_id": "CSAFPID-51001", "product_identification_helper": { "model_numbers": [ "58666" ] } } }, { "category": "product_version", "name": "1.48", "product": { "name": "AT-Modem-Emulator 1.48", "product_id": "CSAFPID-52001" } } ], "category": "product_name", "name": "AT-Modem-Emulator" }, { "branches": [ { "category": "product_version_range", "name": "<1.48", "product": { "name": "Com-Server ++ <1.48", "product_id": "CSAFPID-51002", "product_identification_helper": { "model_numbers": [ "58665" ] } } }, { "category": "product_version", "name": "1.48", "product": { "name": "Com-Server ++ 1.48", "product_id": "CSAFPID-52002" } } ], "category": "product_name", "name": "Com-Server ++" }, { "branches": [ { "category": "product_version_range", "name": "<1.48", "product": { "name": "Com-Server 20mA <1.48", "product_id": "CSAFPID-51003", "product_identification_helper": { "model_numbers": [ "58664" ] } } }, { "category": "product_version", "name": "1.48", "product": { "name": "Com-Server 20mA 1.48", "product_id": "CSAFPID-52003" } } ], "category": "product_name", "name": "Com-Server 20mA" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed 100BaseFX <1.76", "product_id": "CSAFPID-51004", "product_identification_helper": { "model_numbers": [ "58651" ] } } }, { "category": "product_version", "name": "1.76", "product": { "name": "Com-Server Highspeed 100BaseFX 1.76", "product_id": "CSAFPID-52004" } } ], "category": "product_name", "name": "Com-Server Highspeed 100BaseFX" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed 100BaseLX <1.76", "product_id": "CSAFPID-51005", "product_identification_helper": { "model_numbers": [ "58652" ] } } }, { "category": "product_version", "name": "1.76", "product": { "name": "Com-Server Highspeed 100BaseLX 1.76", "product_id": "CSAFPID-52005" } } ], "category": "product_name", "name": "Com-Server Highspeed 100BaseLX" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed 19\" 1Port <1.76", "product_id": "CSAFPID-51006", "product_identification_helper": { "model_numbers": [ "58331" ] } } }, { "category": "product_version", "name": "1.76", "product": { "name": "Com-Server Highspeed 19\" 1Port 1.76", "product_id": "CSAFPID-52006" } } ], "category": "product_name", "name": "Com-Server Highspeed 19\" 1Port" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed 19\" 4Port <1.76", "product_id": "CSAFPID-51007", "product_identification_helper": { "model_numbers": [ "58334" ] } } }, { "category": "product_version", "name": "1.76", "product": { "name": "Com-Server Highspeed 19\" 4Port 1.76", "product_id": "CSAFPID-52007" } } ], "category": "product_name", "name": "Com-Server Highspeed 19\" 4Port" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed Compact <1.76", "product_id": "CSAFPID-51008", "product_identification_helper": { "model_numbers": [ "58231" ] } } }, { "category": "product_version", "name": "1.76", "product": { "name": "Com-Server Highspeed Compact 1.76", "product_id": "CSAFPID-52008" } } ], "category": "product_name", "name": "Com-Server Highspeed Compact" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed Industry <1.76", "product_id": "CSAFPID-51009", "product_identification_helper": { "model_numbers": [ "58631" ] } } }, { "category": "product_name", "name": "1.76", "product": { "name": "Com-Server Highspeed Industry 1.76", "product_id": "CSAFPID-52009" } } ], "category": "product_name", "name": "Com-Server Highspeed Industry" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed Isolated <1.76", "product_id": "CSAFPID-51010", "product_identification_helper": { "model_numbers": [ "58633" ] } } }, { "category": "product_name", "name": "1.76", "product": { "name": "Com-Server Highspeed Isolated 1.76", "product_id": "CSAFPID-52010" } } ], "category": "product_name", "name": "Com-Server Highspeed Isolated" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed OEM <1.76", "product_id": "CSAFPID-51011", "product_identification_helper": { "model_numbers": [ "58431" ] } } }, { "category": "product_name", "name": "1.76", "product": { "name": "Com-Server Highspeed OEM 1.76", "product_id": "CSAFPID-52011" } } ], "category": "product_name", "name": "Com-Server Highspeed OEM" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed Office 1 Port <1.76", "product_id": "CSAFPID-51012", "product_identification_helper": { "model_numbers": [ "58031" ] } } }, { "category": "product_version", "name": "1.76", "product": { "name": "Com-Server Highspeed Office 1 Port 1.76", "product_id": "CSAFPID-52012" } } ], "category": "product_name", "name": "Com-Server Highspeed Office 1 Port" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed Office 4 Port <1.76", "product_id": "CSAFPID-51013", "product_identification_helper": { "model_numbers": [ "58034" ] } } }, { "category": "product_version", "name": "1.76", "product": { "name": "Com-Server Highspeed Office 4 Port 1.76", "product_id": "CSAFPID-52013" } } ], "category": "product_name", "name": "Com-Server Highspeed Office 4 Port" }, { "branches": [ { "category": "product_version_range", "name": "<1.76", "product": { "name": "Com-Server Highspeed PoE <1.76", "product_id": "CSAFPID-51014", "product_identification_helper": { "model_numbers": [ "58641" ] } } }, { "category": "product_version", "name": "1.76", "product": { "name": "Com-Server Highspeed PoE 1.76", "product_id": "CSAFPID-52014" } } ], "category": "product_name", "name": "Com-Server Highspeed PoE" }, { "branches": [ { "category": "product_version_range", "name": "<1.48", "product": { "name": "Com-Server LC <1.48", "product_id": "CSAFPID-51015", "product_identification_helper": { "model_numbers": [ "58661" ] } } }, { "category": "product_version", "name": "1.48", "product": { "name": "Com-Server LC 1.48", "product_id": "CSAFPID-52015" } } ], "category": "product_name", "name": "Com-Server LC" }, { "branches": [ { "category": "product_version_range", "name": "<1.48", "product": { "name": "Com-Server PoE 3 x Isolated <1.48", "product_id": "CSAFPID-51016", "product_identification_helper": { "model_numbers": [ "58662" ] } } }, { "category": "product_version", "name": "1.48", "product": { "name": "Com-Server PoE 3 x Isolated 1.48", "product_id": "CSAFPID-52016" } } ], "category": "product_name", "name": "Com-Server PoE 3 x Isolated" }, { "branches": [ { "category": "product_version_range", "name": "<1.48", "product": { "name": "Com-Server UL <1.48", "product_id": "CSAFPID-51017", "product_identification_helper": { "model_numbers": [ "58669" ] } } }, { "category": "product_version", "name": "1.48", "product": { "name": "Com-Server UL 1.48", "product_id": "CSAFPID-52017" } } ], "category": "product_name", "name": "Com-Server UL" } ], "category": "product_family", "name": "Software" } ], "category": "vendor", "name": "Wiesemann & Theis" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017" ], "summary": "Affected Products" }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-52001", "CSAFPID-52002", "CSAFPID-52003", "CSAFPID-52004", "CSAFPID-52005", "CSAFPID-52006", "CSAFPID-52007", "CSAFPID-52008", "CSAFPID-52009", "CSAFPID-52010", "CSAFPID-52011", "CSAFPID-52012", "CSAFPID-52013", "CSAFPID-52014", "CSAFPID-52015", "CSAFPID-52016", "CSAFPID-52017" ], "summary": "Fixed Products" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-42785", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "description", "text": "Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-52001", "CSAFPID-52002", "CSAFPID-52003", "CSAFPID-52004", "CSAFPID-52005", "CSAFPID-52006", "CSAFPID-52007", "CSAFPID-52008", "CSAFPID-52009", "CSAFPID-52010", "CSAFPID-52011", "CSAFPID-52012", "CSAFPID-52013", "CSAFPID-52014", "CSAFPID-52015", "CSAFPID-52016", "CSAFPID-52017" ], "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017" ] }, "remediations": [ { "category": "vendor_fix", "details": "- Update Com-Server Family to version 1.48 or higher.\n\n- Update the Com-Server Highspeed Family to version 1.76 or higher.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017" ] } ], "title": "CVE-2022-42785" }, { "cve": "CVE-2022-42787", "cwe": { "id": "CWE-334", "name": "Small Space of Random Values" }, "notes": [ { "category": "description", "text": "Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to the his account on the the device.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-52001", "CSAFPID-52002", "CSAFPID-52003", "CSAFPID-52004", "CSAFPID-52005", "CSAFPID-52006", "CSAFPID-52007", "CSAFPID-52008", "CSAFPID-52009", "CSAFPID-52010", "CSAFPID-52011", "CSAFPID-52012", "CSAFPID-52013", "CSAFPID-52014", "CSAFPID-52015", "CSAFPID-52016", "CSAFPID-52017" ], "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017" ] }, "remediations": [ { "category": "vendor_fix", "details": "- Update Com-Server Family to version 1.48 or higher.\n\n- Update the Com-Server Highspeed Family to version 1.76 or higher.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "environmentalScore": 9.8, "environmentalSeverity": "CRITICAL", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 9.8, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017" ] } ], "title": "CVE-2022-42787" }, { "cve": "CVE-2022-42786", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "description", "text": "Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage.", "title": "Vulnerability Description" } ], "product_status": { "fixed": [ "CSAFPID-52001", "CSAFPID-52002", "CSAFPID-52003", "CSAFPID-52004", "CSAFPID-52005", "CSAFPID-52006", "CSAFPID-52007", "CSAFPID-52008", "CSAFPID-52009", "CSAFPID-52010", "CSAFPID-52011", "CSAFPID-52012", "CSAFPID-52013", "CSAFPID-52014", "CSAFPID-52015", "CSAFPID-52016", "CSAFPID-52017" ], "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017" ] }, "remediations": [ { "category": "vendor_fix", "details": "- Update Com-Server Family to version 1.48 or higher.\n\n- Update the Com-Server Highspeed Family to version 1.76 or higher.", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.4, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "temporalScore": 5.4, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005", "CSAFPID-51006", "CSAFPID-51007", "CSAFPID-51008", "CSAFPID-51009", "CSAFPID-51010", "CSAFPID-51011", "CSAFPID-51012", "CSAFPID-51013", "CSAFPID-51014", "CSAFPID-51015", "CSAFPID-51016", "CSAFPID-51017" ] } ], "title": "CVE-2022-42786" } ] }