Wiesemann & Theis: XSS vulnerability in web interface of the Com-Server family
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0058 47th percentileScored 2026-11-07
Fix Fixed Com-Server LC (Wiesemann & Theis): 1.48Com-Server PoE 3 x Isolated (Wiesemann & Theis): 1.48+15 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wiesemann & Theis | Com-Server LC | 1.0 to before 1.48 | 1.48 | Patch available | CNA |
| Wiesemann & Theis | Com-Server PoE 3 x Isolated | 1.0 to before 1.48 | 1.48 | Patch available | CNA |
| Wiesemann & Theis | Com-Server 20mA | 1.0 to before 1.48 | 1.48 | Patch available | CNA |
| Wiesemann & Theis | Com-Server ++ | 1.0 to before 1.48 | 1.48 | Patch available | CNA |
| Wiesemann & Theis | AT-Modem-Emulator | 1.0 to before 1.48 | 1.48 | Patch available | CNA |
| Wiesemann & Theis | Com-Server UL | 1.0 to before 1.48 | 1.48 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed 100BaseFX | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed 100BaseLX | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed Office 1 Port | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed Office 4 Port | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed Industry | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed OEM | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed Compact | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed Isolated | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed 19" 1Port | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed 19" 4Port | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
| Wiesemann & Theis | Com-Server Highspeed PoE | 1.0 to before 1.76 | 1.76 | Patch available | CNA |
- Com-Server LC VendorWiesemann & Theis Affected 1.0 to before 1.48 Fixed in 1.48 Patch available CNA
- Com-Server PoE 3 x Isolated VendorWiesemann & Theis Affected 1.0 to before 1.48 Fixed in 1.48 Patch available CNA
- Com-Server 20mA VendorWiesemann & Theis Affected 1.0 to before 1.48 Fixed in 1.48 Patch available CNA
- Com-Server ++ VendorWiesemann & Theis Affected 1.0 to before 1.48 Fixed in 1.48 Patch available CNA
- AT-Modem-Emulator VendorWiesemann & Theis Affected 1.0 to before 1.48 Fixed in 1.48 Patch available CNA
- Com-Server UL VendorWiesemann & Theis Affected 1.0 to before 1.48 Fixed in 1.48 Patch available CNA
- Com-Server Highspeed 100BaseFX VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed 100BaseLX VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed Office 1 Port VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed Office 4 Port VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed Industry VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed OEM VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed Compact VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed Isolated VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed 19" 1Port VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed 19" 4Port VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
- Com-Server Highspeed PoE VendorWiesemann & Theis Affected 1.0 to before 1.76 Fixed in 1.76 Patch available CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:wut:at-modem-emulator_firmware:*:*:*:*:*:*:*:* | before 1.48 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:at-modem-emulator:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_\+\+_firmware:*:*:*:*:*:*:*:* | before 1.48 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_\+\+:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_20ma_firmware:*:*:*:*:*:*:*:* | before 1.48 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_20ma:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_100basefx_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_100basefx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_100baselx_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_100baselx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
- cpe:2.3:o:wut:at-modem-emulator_firmware:*:*:*:*:*:*:*:* Versions before 1.48 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:at-modem-emulator:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_\+\+_firmware:*:*:*:*:*:*:*:* Versions before 1.48 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_\+\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_20ma_firmware:*:*:*:*:*:*:*:* Versions before 1.48 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_20ma:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_100basefx_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_100basefx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_100baselx_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_100baselx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:wut:com-server_highspeed_19\"_1port_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_19\"_1port:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_19\"_4port_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_19\"_4port:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_compact_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_compact:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_industry_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_industry:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_isolated_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_isolated:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_oem_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_oem:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_office_1port_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_office_1port:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_office_4port_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_office_4port:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_poe_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_poe:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_lc_firmware:*:*:*:*:*:*:*:* | before 1.48 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_lc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_ul_firmware:*:*:*:*:*:*:*:* | before 1.48 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_ul:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
| cpe:2.3:o:wut:com-server_highspeed_poe_3x_isolated_firmware:*:*:*:*:*:*:*:* | before 1.48 | Vulnerable | Wiesemann & Theis |
| cpe:2.3:h:wut:com-server_highspeed_poe_3x_isolated:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Wiesemann & Theis |
- cpe:2.3:o:wut:com-server_highspeed_19\"_1port_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_19\"_1port:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_19\"_4port_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_19\"_4port:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_compact_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_compact:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_industry_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_industry:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_isolated_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_isolated:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_oem_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_oem:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_office_1port_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_office_1port:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_office_4port_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_office_4port:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_poe_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_poe:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_lc_firmware:*:*:*:*:*:*:*:* Versions before 1.48 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_lc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_ul_firmware:*:*:*:*:*:*:*:* Versions before 1.48 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_ul:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
- cpe:2.3:o:wut:com-server_highspeed_poe_3x_isolated_firmware:*:*:*:*:*:*:*:* Versions before 1.48 Vulnerable ·Wiesemann & Theis
- cpe:2.3:h:wut:com-server_highspeed_poe_3x_isolated:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Wiesemann & Theis
Remediation
- Fix · CNA Com-Server LC (Wiesemann & Theis) Fixed in 1.48
- Fix · CNA Com-Server PoE 3 x Isolated (Wiesemann & Theis) Fixed in 1.48
- Fix · CNA Com-Server 20mA (Wiesemann & Theis) Fixed in 1.48
- Fix · CNA Com-Server ++ (Wiesemann & Theis) Fixed in 1.48
- Fix · CNA AT-Modem-Emulator (Wiesemann & Theis) Fixed in 1.48
- Fix · CNA Com-Server UL (Wiesemann & Theis) Fixed in 1.48
- Fix · CNA Com-Server Highspeed 100BaseFX (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed 100BaseLX (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed Office 1 Port (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed Office 4 Port (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed Industry (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed OEM (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed Compact (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed Isolated (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed 19" 1Port (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed 19" 4Port (Wiesemann & Theis) Fixed in 1.76
- Fix · CNA Com-Server Highspeed PoE (Wiesemann & Theis) Fixed in 1.76
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Wiesemann & Theis AT-Modem-Emulator, Com-Server ++ and 15 more products 1.48, 1.76
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-20802 Wiesemann & Theis: Authentication bypass in Com-Server familyPriority MEDIUM 44
- TI-2022-20804 Wiesemann & Theis: Small number space for allocating session id in Com-Server familyPriority MEDIUM 40
Timeline
- 2026-10-02 Threatist record created from CVE-2022-42786
- 2026-10-03 Alias added: GHSA-ffmc-cj3h-9wwj
References
More Wiesemann & Theis At-modem-emulator Firmware vulnerabilities
- TI-2022-20802 Wiesemann & Theis: Authentication bypass in Com-Server family CVSS 3.1CRITICAL 9.8
- TI-2022-20804 Wiesemann & Theis: Small number space for allocating session id in Com-Server family CVSS 3.1HIGH 8.8
Sources
- CVE-2022-42786 · CVE Program
- CVE-2022-42786 · NVD
- FIRST EPSS
- GHSA-ffmc-cj3h-9wwj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences