Wiesemann & Theis: Multiple products prone to missing authentication through spoofing

Description

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.

Scores

EPSS (exploitation in 30 days)

0.35% · top 72% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.

Weakness

• CWE-290 Authentication Bypass by Spoofing (opens in a new tab)All about CWE-290 and its CVEs

Affected products

• Wiesemann & Theis · Com-Server ++

  • affected < 1.55

• Wiesemann & Theis · Com-Server 20mA

  • affected < 1.55

• Wiesemann & Theis · Com-Server Highspeed 100BaseFX

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed 100BaseLX

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed 19" 1Port

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed 19" 4Port

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed Compact

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed Industry

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed Isolated

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed OEM

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed Office 1 Port

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed Office 4 Port

  • affected < 1.78

• Wiesemann & Theis · Com-Server Highspeed PoE

  • affected < 1.78

• Wiesemann & Theis · Com-Server LC

  • affected < 1.55

• Wiesemann & Theis · Com-Server PoE 3 x Isolated

  • affected < 1.55

• Wiesemann & Theis · Com-Server UL

  • affected < 1.55

References (1)

• https://cert.vde.com/en/advisories/VDE-2022-057/ (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-4098](https://trackcve.app/badge/CVE-2022-4098.svg)](https://trackcve.app/cve/CVE-2022-4098)

Record last updated 14 Apr 2025, 18:12 UTC.