Weintek EasyWeb cMT Code Injection
CVE-2021-27446

10CRITICAL

Key Information:

Vendor

Weintek

Status
Cmt-svr-1xx/2xx
Cmt-g01/g02
Cmt-g03/g04
Cmt3071/cmt3072/cmt3090/cmt3103/cmt3151
Vendor
CVE Published:
16 May 2022

What is CVE-2021-27446?

The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.

Affected Version(s)

cMT-CTRL01 < 20210302

cMT-FHD < 20210208

cMT-G01/G02 < 20210209

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01
x_refsource_MISC
https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_...
x_refsource_CONFIRM

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcin Dudek from CERT.PL reported these vulnerabilities to CISA.
.