CVE-2022-42786: Wiesemann & Theis: XSS vulnerability in web interface of the Com-Server family

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-10 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage

Affected products

Wut At-Modem-Emulator Firmware: before 1.48 — fixed in 1.48
Wut Com-Server ++ Firmware: before 1.48 — fixed in 1.48
Wut Com-Server 20Ma Firmware: before 1.48 — fixed in 1.48
Wut Com-Server Highspeed 100Basefx Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed 100Baselx Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed 19" 1Port Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed 19" 4Port Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Compact Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Industry Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Isolated Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Lc Firmware: before 1.48 — fixed in 1.48
Wut Com-Server Highspeed Oem Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Office 1Port Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Office 4Port Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Poe 3X Isolated Firmware: before 1.48 — fixed in 1.48
Wut Com-Server Highspeed Poe Firmware: before 1.76 — fixed in 1.76
Wut Com-Server Highspeed Ul Firmware: before 1.48 — fixed in 1.48

How to fix

Upgrade to a fixed version: Wut At-Modem-Emulator Firmware 1.48; Wut Com-Server ++ Firmware 1.48; Wut Com-Server 20Ma Firmware 1.48; Wut Com-Server Highspeed 100Basefx Firmware 1.76; Wut Com-Server Highspeed 100Baselx Firmware 1.76; Wut Com-Server Highspeed 19" 1Port Firmware 1.76; Wut Com-Server Highspeed 19" 4Port Firmware 1.76; Wut Com-Server Highspeed Compact Firmware 1.76; Wut Com-Server Highspeed Industry Firmware 1.76; Wut Com-Server Highspeed Isolated Firmware 1.76; Wut Com-Server Highspeed Lc Firmware 1.48; Wut Com-Server Highspeed Oem Firmware 1.76. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-42786 or the next vulnerability affects your stack