CVSS 3.1
8.0 highCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2022-4098
High (8.0) in wut. EPSS 0.3% chance of exploitation in the next 30 days.
Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
- CWE
- CWE-290
- Published
- Modified
- Record from
- the NVD, synced
Affected
- wut:com-server_20ma_firmware
- wut:com-server_\+\+_firmware
- wut:com-server_highspeed_100basefx_firmware
- wut:com-server_highspeed_100baselx_firmware
- wut:com-server_highspeed_19\"_1port_firmware
- wut:com-server_highspeed_19\"_4port_firmware
- wut:com-server_highspeed_compact_firmware
- wut:com-server_highspeed_industry_firmware
- wut:com-server_highspeed_isolated_firmware
- wut:com-server_highspeed_lc_firmware
- wut:com-server_highspeed_oem_firmware
- wut:com-server_highspeed_office_1port_firmware
- wut:com-server_highspeed_office_4port_firmware
- wut:com-server_highspeed_poe_3x_isolated_firmware
- wut:com-server_highspeed_poe_firmware
- wut:com-server_highspeed_ul_firmware