CVE-2022-4098
Wiesemann & Theis: Multiple products prone to missing authentication through spoofing
- 8.0HighCVSS base score
- 0.35%Exploitation in 30 daysEPSS · top 71% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.
Timeline
ID reserved
By CERTVDE
- 22 days later
· 22 days later
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CERTVDECNA (assigner) | 3.1 | High8.0 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.0 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.35% · top 71% of all CVEs (11 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.
Affected products
Wiesemann & Theis · Com-Server ++
- affected < 1.55
Wiesemann & Theis · Com-Server 20mA
- affected < 1.55
Wiesemann & Theis · Com-Server Highspeed 100BaseFX
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed 100BaseLX
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed 19" 1Port
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed 19" 4Port
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed Compact
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed Industry
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed Isolated
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed OEM
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed Office 1 Port
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed Office 4 Port
- affected < 1.78
Wiesemann & Theis · Com-Server Highspeed PoE
- affected < 1.78
Wiesemann & Theis · Com-Server LC
- affected < 1.55
Wiesemann & Theis · Com-Server PoE 3 x Isolated
- affected < 1.55
Wiesemann & Theis · Com-Server UL
- affected < 1.55
References
References1
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2022-51468 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-4098)Record last updated .