CVE-2022-42787 HIGH

CVE-2022-42787: Wiesemann & Theis: Small number space for allocating session id in Com-Server family

Vendor Wiesemann & Theis
Product Com-Server LC
Weakness CWE-330 · Insufficient randomness
Published November 10, 2022
Last update May 1, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an user an unathenticated remote attacker can brute force the users session id and get access to his account on the the device. As the user needs to log in for the attack to be successful a user interaction is required.

Key dates

02Disclosure timeline

November 10, 2022 CVE published
May 1, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-42155 Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs CVE-2025-13353 gokey allows secret recovery from a seed file without the master password CVE-2025-12787 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation CVE-2026-40496 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVE-2024-47188 Suricata http/byte-ranges: missing hashtable random seed leads to potential DoS