CVE-2022-42785: Wiesemann & Theis: Authentication bypass in Com-Server family

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-15 · updated 2026-06-17
Weakness: CWE-306

Description

Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.

Affected products

Wut At-Modem-Emulator Firmware: before 1.48 — fixed in 1.48
Wut Com-Server ++ Firmware: before 1.48 — fixed in 1.48
Wut Com-Server 20Ma Firmware: before 1.48 — fixed in 1.48
Wut Com-Server Highspeed 100Basefx Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed 100Baselx Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed 19" 1Port Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed 19" 4Port Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Compact Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Industry Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Isolated Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Lc Firmware: before 1.48 — fixed in 1.48
Wut Com-Server Highspeed Oem Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Office 1Port Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Office 4Port Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Poe 3X Isolated Firmware: before 1.48 — fixed in 1.48
Wut Com-Server Highspeed Poe Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Ul Firmware: before 1.48 — fixed in 1.48

How to fix

Upgrade to a fixed version: Wut At-Modem-Emulator Firmware 1.48; Wut Com-Server ++ Firmware 1.48; Wut Com-Server 20Ma Firmware 1.48; Wut Com-Server Highspeed 100Basefx Firmware 1.76; Wut Com-Server Highspeed 100Baselx Firmware 1.76; Wut Com-Server Highspeed 19" 1Port Firmware 1.76; Wut Com-Server Highspeed 19" 4Port Firmware 1.76; Wut Com-Server Highspeed Compact Firmware 1.76; Wut Com-Server Highspeed Industry Firmware 1.76; Wut Com-Server Highspeed Isolated Firmware 1.76; Wut Com-Server Highspeed Lc Firmware 1.48; Wut Com-Server Highspeed Oem Firmware 1.76. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-42785 or the next vulnerability affects your stack