What is the CVSS score of CVE-2022-4098?

CVE-2022-4098 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Com Server Firmware CVE-2022-4098

HIGH

Authentication Bypass by Spoofing (CWE-290)

2022-12-13 info@cert.vde.com

8.0

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.0 HIGH

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 13, 2022 - 08:15 cve.org

HIGH 8.0

DescriptionCVE.org

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device.

AnalysisAI

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. Rated high severity (CVSS 8.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-290. Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the Com-Server an unauthenticated attacker in the same subnet can obtain the session ID and through IP spoofing change arbitrary settings by crafting modified HTTP Get requests. This may result in a complete takeover of the device. Affected products include: Wut Com-Server \+\+ Firmware, Wut Com-Server 20Ma Firmware, Wut Com-Server Highspeed 100Basefx Firmware, Wut Com-Server Highspeed 100Baselx Firmware, Wut Com-Server Highspeed 19\" 1Port Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.