CVE-2022-4098CWE-290

Wiesemann & Theis: Multiple products prone to missing authentication through spoofing

High · published December 13, 2022

CVSS v3.1
8.0
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00346 · 26.9th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2022-12-13T07:26Z
EPSS history
Timeline
  • 13 DEC 07:26Z
    Wiesemann & Theis: Multiple products prone to missing authentication through spoofing
    cvelistv5