{"id":"CVE-2022-42787","aliases":["EUVD-2022-45850","GHSA-qgc9-3m4w-r9w2"],"status":"published","title":"Wiesemann \u0026 Theis: Small number space for allocating session id in Com-Server family","description":"Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00887,"percentile":0.59542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-330"],"published":"2022-11-10T11:06:20Z","modified":"2026-06-17T05:05:19Z","products":[{"vendor":"wiesemann \u0026 theis","product":"at-modem-emulator"},{"vendor":"wiesemann \u0026 theis","product":"com-server ++"},{"vendor":"wiesemann \u0026 theis","product":"com-server 20ma"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed 100basefx"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed 100baselx"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed 19\" 1port"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed 19\" 4port"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed compact"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed industry"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed isolated"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed oem"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed office 1 port"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed office 4 port"},{"vendor":"wiesemann \u0026 theis","product":"com-server highspeed poe"},{"vendor":"wiesemann \u0026 theis","product":"com-server lc"},{"vendor":"wiesemann \u0026 theis","product":"com-server poe 3 x isolated"},{"vendor":"wiesemann \u0026 theis","product":"com-server ul"},{"vendor":"wut","product":"at-modem-emulator_firmware"},{"vendor":"wut","product":"com-server_20ma_firmware"},{"vendor":"wut","product":"com-server_\\+\\+_firmware"},{"vendor":"wut","product":"com-server_highspeed_100basefx_firmware"},{"vendor":"wut","product":"com-server_highspeed_100baselx_firmware"},{"vendor":"wut","product":"com-server_highspeed_19\\\"_1port_firmware"},{"vendor":"wut","product":"com-server_highspeed_19\\\"_4port_firmware"},{"vendor":"wut","product":"com-server_highspeed_compact_firmware"},{"vendor":"wut","product":"com-server_highspeed_industry_firmware"},{"vendor":"wut","product":"com-server_highspeed_isolated_firmware"},{"vendor":"wut","product":"com-server_highspeed_lc_firmware"},{"vendor":"wut","product":"com-server_highspeed_oem_firmware"},{"vendor":"wut","product":"com-server_highspeed_office_1port_firmware"},{"vendor":"wut","product":"com-server_highspeed_office_4port_firmware"},{"vendor":"wut","product":"com-server_highspeed_poe_3x_isolated_firmware"},{"vendor":"wut","product":"com-server_highspeed_poe_firmware"},{"vendor":"wut","product":"com-server_highspeed_ul_firmware"}],"references":[{"url":"https://cert.vde.com/de/advisories/VDE-2022-043","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42787"},{"url":"https://github.com/advisories/GHSA-qgc9-3m4w-r9w2"}],"sources":{"cve":[{"id":"CVE-2022-42787","title":"Wiesemann \u0026 Theis: Small number space for allocating session id in Com-Server family","description":"Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.","status":"published","published":"2022-11-10T11:06:20.856Z","modified":"2025-05-01T19:01:20.74Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-45850","description":"Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.","status":"published","published":"2022-11-10T11:06:20Z","modified":"2025-05-01T19:01:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:51:56.360543Z"}],"ghsa":[{"id":"GHSA-qgc9-3m4w-r9w2","title":"Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions...","description":"Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. An unathenticated remote attacker can brute force the session id and gets access to an account on the the device.","status":"published","published":"2022-11-10T19:01:11Z","modified":"2023-01-27T05:02:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:42:03.063922Z"}],"nvd":[{"id":"CVE-2022-42787","description":"Multiple W\u0026T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.","status":"published","published":"2022-11-10T12:15:10.927Z","modified":"2026-06-17T05:05:19.743Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:07:31.914793Z"}]}}