CVE-2022-42787 Wiesemann & Theis: Small number space for allocating session id in Com-Server family
An attacker can brute force session IDs to hijack user accounts on W&T Com-Server devices after a user logs in.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-42787?
CVE-2022-42787 is a high-severity authentication bypass vulnerability in Wiesemann & Theis AT-Modem-Emulator, published on 10 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
Weakness: CWE-330
Which versions are affected by CVE-2022-42787?
It affects 17 products.
Products include Wut At-Modem-Emulator Firmware, Wut Com-Server 20ma Firmware, Wut Com-Server \+\+ Firmware, Wut Com-Server Highspeed 100basefx Firmware, Wut Com-Server Highspeed 100baselx Firmware, Wut Com-Server Highspeed 19\" 1port Firmware and 11 more.
How do I fix CVE-2022-42787?
No fix has been published for CVE-2022-42787 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-42787 being exploited?
There is no known exploitation of CVE-2022-42787 in the wild and no public exploit code.
Other vulnerabilities in Wiesemann & Theis AT-Modem-Emulator
Sources
Also known as GHSA-qgc9-3m4w-r9w2.