Wiesemann & Theis Com-Server Family 安全漏洞
CVE编号
CVE-2022-4098利用情况
暂无补丁情况
N/A披露时间
2022-12-13漏洞描述
Wiesemann & Theis Com-Server Family是德国Wiesemann & Theis公司的一系列串行设备服务器。 Wiesemann & Theis Com-Server Family 存在安全漏洞，该漏洞源于容易通过 IP 欺骗绕过身份验证，在与 Com-Server 的 WBM 的经过身份验证的会话期间，同一子网中未经身份验证的攻击者可以获得会话 ID，并通过 IP 欺骗通过制作修改后的 HTTP Get 请求来更改任意设置，这可能会导致完全接管设备。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| https://cert.vde.com/en/advisories/VDE-2022-057/ |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | kernel | * | Up to (excluding) 5.15.128-80.144.amzn2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_37 | microcode_ctl | * | Up to (excluding) 2.1-53.2.fc37 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_38 | microcode_ctl | * | Up to (excluding) 2.1-55.1.fc38 | |||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_8 | oraclelinux-release | * | Up to (excluding) 12.2.1-7.4.0.2.el9 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP5 | kernel | * | Up to (excluding) 4.12.14-16.146.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_++_firmware | * | Up to (excluding) 1.55 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_20ma_firmware | * | Up to (excluding) 1.55 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_100basefx_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_100baselx_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_19"_1port_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_19"_4port_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_compact_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_industry_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_isolated_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_lc_firmware | * | Up to (excluding) 1.55 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_oem_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_office_1port_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_office_4port_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_poe_3x_isolated_firmware | * | Up to (excluding) 1.55 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_poe_firmware | * | Up to (excluding) 1.78 | |||||
| 运行在以下环境 | |||||||||
| 系统 | wut | com-server_highspeed_ul_firmware | * | Up to (excluding) 1.55 | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_++ | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_20ma | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_100basefx | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_100baselx | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_19"_1port | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_19"_4port | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_compact | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_industry | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_isolated | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_lc | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_oem | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_office_1port | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_office_4port | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_poe | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_poe_3x_isolated | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | wut | com-server_highspeed_ul | - | - | |||||
- 攻击路径 相邻
- 攻击复杂度 低
- 权限要求 无
- 影响范围 未更改
- 用户交互 无
- 可用性 高
- 保密性 高
- 完整性 高
| CWE-ID | 漏洞类型 |
| CWE-290 | 使用欺骗进行的认证绕过 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论