CVE-2022-42787CWE-330

Wiesemann & Theis: Small number space for allocating session id in Com-Server family

High · published November 10, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00798 · 56.1th percentile
Weakness
CWE-330 · Use of Insufficiently Random Values
Published
2022-11-10T11:06Z
EPSS history
Timeline
  • 10 NOV 11:06Z
    Wiesemann & Theis: Small number space for allocating session id in Com-Server family
    cvelistv5