CVE-2021-27444

Published: May 16, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.

Affected (16)

Products: Weintek: Cmt Svr 100 Firmware, Cmt Svr 102 Firmware, Cmt Svr 200 Firmware, Cmt Svr 202 Firmware, Cmt G01 Firmware, Cmt G02 Firmware, Cmt G03 Firmware, Cmt G04 Firmware, Cmt3071 Firmware, Cmt3072 Firmware, Cmt3090 Firmware, Cmt3103 Firmware, Cmt3151 Firmware, Cmt Hdm Firmware, Cmt Fhd Firmware, Cmt Ctrl01 Firmware

16 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt Svr 100 Firmware	Before 20210305

Running on/with	Platform Versions
Weintek Cmt Svr 100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt Svr 102 Firmware	Before 20210305

Running on/with	Platform Versions
Weintek Cmt Svr 102	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt Svr 200 Firmware	Before 20210305

Running on/with	Platform Versions
Weintek Cmt Svr 200	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt Svr 202 Firmware	Before 20210305

Running on/with	Platform Versions
Weintek Cmt Svr 202	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt G01 Firmware	Before 20210209

Running on/with	Platform Versions
Weintek Cmt G01	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt G02 Firmware	Before 20210209

Running on/with	Platform Versions
Weintek Cmt G02	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt G03 Firmware	Before 20210222

Running on/with	Platform Versions
Weintek Cmt G03	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt G04 Firmware	Before 20210222

Running on/with	Platform Versions
Weintek Cmt G04	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt3071 Firmware	Before 20210218

Running on/with	Platform Versions
Weintek Cmt3071	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt3072 Firmware	Before 20210218

Running on/with	Platform Versions
Weintek Cmt3072	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt3090 Firmware	Before 20210218

Running on/with	Platform Versions
Weintek Cmt3090	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt3103 Firmware	Before 20210218

Running on/with	Platform Versions
Weintek Cmt3103	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt3151 Firmware	Before 20210218

Running on/with	Platform Versions
Weintek Cmt3151	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt Hdm Firmware	Before 20210204

Running on/with	Platform Versions
Weintek Cmt Hdm	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt Fhd Firmware	Before 20210208

Running on/with	Platform Versions
Weintek Cmt Fhd	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Weintek Cmt Ctrl01 Firmware	Before 20210302

Running on/with	Platform Versions
Weintek Cmt Ctrl01	All versions

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (4)

https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf

Source: ics-cert@hq.dhs.gov

MitigationVendor Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.