CVE-2022-42787
Wiesemann & Theis: Small number space for allocating session id in Com-Server family
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Wiesemann & Theis: Small number space for allocating session id in Com-Server family
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
- Record
CVE-2022-42787- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-330
- Updated
- 2026-11-02
EUVDEUVD-2022-45850
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
- Record
EUVD-2022-45850- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qgc9-3m4w-r9w2
Multiple W&T products of the Comserver Series use a small number space for allocating sessions...
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. An unathenticated remote attacker can brute force the session id and gets access to an account on the the device.
- Record
GHSA-qgc9-3m4w-r9w2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-330
- Updated
- 2026-11-02
NVD
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
- Record
CVE-2022-42787- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-330
- Updated
- 2026-11-02
Affected products
- wiesemann & theis at-modem-emulator
- wiesemann & theis com-server ++
- wiesemann & theis com-server 20ma
- wiesemann & theis com-server highspeed 100basefx
- wiesemann & theis com-server highspeed 100baselx
- wiesemann & theis com-server highspeed 19" 1port
- wiesemann & theis com-server highspeed 19" 4port
- wiesemann & theis com-server highspeed compact
- wiesemann & theis com-server highspeed industry
- wiesemann & theis com-server highspeed isolated
- wiesemann & theis com-server highspeed oem
- wiesemann & theis com-server highspeed office 1 port
Show 22 moreShow less
- wiesemann & theis com-server highspeed office 4 port
- wiesemann & theis com-server highspeed poe
- wiesemann & theis com-server lc
- wiesemann & theis com-server poe 3 x isolated
- wiesemann & theis com-server ul
- wut at-modem-emulator firmware
- wut com-server 20ma firmware
- wut com-server \+\+ firmware
- wut com-server highspeed 100basefx firmware
- wut com-server highspeed 100baselx firmware
- wut com-server highspeed 19\" 1port firmware
- wut com-server highspeed 19\" 4port firmware
- wut com-server highspeed compact firmware
- wut com-server highspeed industry firmware
- wut com-server highspeed isolated firmware
- wut com-server highspeed lc firmware
- wut com-server highspeed oem firmware
- wut com-server highspeed office 1port firmware
- wut com-server highspeed office 4port firmware
- wut com-server highspeed poe 3x isolated firmware
- wut com-server highspeed poe firmware
- wut com-server highspeed ul firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-42787 is a high vulnerability (CVSS 8.8) in Wiesemann & Theis At-modem-emulator, published November 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. No source names a fixed version.