← Back

CVE-2023-43492

nvd nist
Published: Oct 19, 2023Modified: Nov 21, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.

Affected (7)

Weintek
7 products
Cmt Fhd Firmware
Cmt Hdm Firmware
Cmt3071 Firmware
Cmt3072 Firmware
Cmt3090 Firmware
Cmt3103 Firmware
Cmt3151 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Cmt Fhd Firmware
Before 20210212
Running on/withPlatform Versions
Weintek
Cmt Fhd
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Cmt Hdm Firmware
Before 20210206
Running on/withPlatform Versions
Weintek
Cmt Hdm
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Cmt3071 Firmware
Before 20210220
Running on/withPlatform Versions
Weintek
Cmt3071
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Cmt3072 Firmware
Before 20210220
Running on/withPlatform Versions
Weintek
Cmt3072
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Cmt3090 Firmware
Before 20210220
Running on/withPlatform Versions
Weintek
Cmt3090
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Cmt3103 Firmware
Before 20210220
Running on/withPlatform Versions
Weintek
Cmt3103
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Cmt3151 Firmware
Before 20210220
Running on/withPlatform Versions
Weintek
Cmt3151
All versions

Related CWEs

CWE-121
Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-787
Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.

References (4)

Source: ics-cert@hq.dhs.gov
ExploitVendor Advisory
Source: ics-cert@hq.dhs.gov
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource

Timeline

No history available yet.