Vulnerabilities

An unauthenticated remote attacker can get access without password protection to the affected device.

An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.

An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems.

A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product.

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing.

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids.

Multiple W&T Products of the ComServer Series are prone to an XSS attack.

Multiple W&T products of the ComServer Series are prone to an authentication bypass.