CVE-2022-42787
High
Description
Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.
SeverityHigh
CVSS8.8
Exploit probability—
ProductWut At-modem-emulator Firmware
PublishedNov 10, 2022
First seenNov 10, 2022
Weakness typeCWE-330CWE-330
How to fix
Update
- wut at-modem-emulator_firmware1.48 or later
- wut com-server_\+\+_firmware1.48 or later
- wut com-server_20ma_firmware1.48 or later
- wut com-server_highspeed_100basefx_firmware1.76 or later
- wut com-server_highspeed_100baselx_firmware1.76 or later
- wut com-server_highspeed_19\"_1port_firmware1.76 or later
- wut com-server_highspeed_19\"_4port_firmware1.76 or later
- wut com-server_highspeed_compact_firmware1.76 or later
- wut com-server_highspeed_industry_firmware1.76 or later
- wut com-server_highspeed_isolated_firmware1.76 or later
- wut com-server_highspeed_oem_firmware1.76 or later
- wut com-server_highspeed_office_1port_firmware1.76 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wut at-modem-emulator_firmware | v < 1.48 | 1.48 |
| wut com-server_\+\+_firmware | v < 1.48 | 1.48 |
| wut com-server_20ma_firmware | v < 1.48 | 1.48 |
| wut com-server_highspeed_100basefx_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_100baselx_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_19\"_1port_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_19\"_4port_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_compact_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_industry_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_isolated_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_oem_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_office_1port_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_office_4port_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_poe_firmware | v < 1.76 | 1.76 |
| wut com-server_highspeed_lc_firmware | v < 1.48 | 1.48 |
| wut com-server_highspeed_ul_firmware | v < 1.48 | 1.48 |
| wut com-server_highspeed_poe_3x_isolated_firmware | v < 1.48 | 1.48 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.