title: Wiesemann & Theis: Authentication bypass in Com-Server family
description: Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the password by crafting a modified HTTP GET Request.
problem types: CWE-306 Missing Authentication for Critical Function
affected:
{
defaultStatus: unaffected
product: Com-Server LC
vendor: Wiesemann & Theis
versions:
lessThan: 1.48, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server PoE 3 x Isolated
vendor: Wiesemann & Theis
versions:
lessThan: 1.48, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server 20mA
vendor: Wiesemann & Theis
versions:
lessThan: 1.48, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server ++
vendor: Wiesemann & Theis
versions:
lessThan: 1.48, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: AT-Modem-Emulator
vendor: Wiesemann & Theis
versions:
lessThan: 1.48, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server UL
vendor: Wiesemann & Theis
versions:
lessThan: 1.48, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed 100BaseFX
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed 100BaseLX
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed Office 1 Port
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed Office 4 Port
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed Industry
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed OEM
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed Compact
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed Isolated
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed 19" 1Port
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed 19" 4Port
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
{
defaultStatus: unaffected
product: Com-Server Highspeed PoE
vendor: Wiesemann & Theis
versions:
lessThan: 1.76, status: affected, version: 1.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL