Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.
Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.
| Vendor | Product | Versions |
|---|---|---|
| Wiesemann & Theis | Com | Server LC — 1.0 |
| Wiesemann & Theis | Com | Server PoE 3 x Isolated — 1.0 |
| Wiesemann & Theis | Com | Server 20mA — 1.0 |
| Wiesemann & Theis | Com | Server ++ — 1.0 |
| Wiesemann & Theis | AT | Modem-Emulator — 1.0 |
| Wiesemann & Theis | Com | Server UL — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed 100BaseFX — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed 100BaseLX — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed Office 1 Port — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed Office 4 Port — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed Industry — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed OEM — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed Compact — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed Isolated — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed 19" 1Port — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed 19" 4Port — 1.0 |
| Wiesemann & Theis | Com | Server Highspeed PoE — 1.0 |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.