Weintek EasyWeb cMT Cross-site Scripting
CVE-2021-27442

9.4CRITICAL

Key Information:

Vendor: Weintek
Status: Cmt-svr-1xx/2xx; Cmt-g01/g02; Cmt-g03/g04; Cmt3071/cmt3072/cmt3090/cmt3103/cmt3151
Vendor: CVE Published:; 16 May 2022

What is CVE-2021-27442?

The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.

Affected Version(s)

cMT-CTRL01 < 20210302

cMT-FHD < 20210208

cMT-G01/G02 < 20210209

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01

x_refsource_MISC

https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_...

x_refsource_CONFIRM

CVSS V3.1

Score:

9.4

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 16, 2022
Vulnerability Reserved
Feb 19, 2021

Credit

Marcin Dudek from CERT.PL reported these vulnerabilities to CISA.

CVE-2021-27442 Data

JSON