Vulnerability · Published May 16, 2022 · Assigned by icscert
CVE-2021-27444Weintek EasyWeb cMT Improper Access Control
Critical 9.8
In plain English
A critical-severity improper access control in cMT-CTRL01 from Weintek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.2%top 32.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Weintek | cMT-SVR-1xx/2xx | unspecified – before 20210305 |
| Weintek | cMT-G01/G02 | unspecified – before 20210209 |
| Weintek | cMT-G03/G04 | unspecified – before 20210222 |
| Weintek | cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 | unspecified – before 20210218 |
| Weintek | cMT-HDM | unspecified – before 20210204 |
| Weintek | cMT-FHD | unspecified – before 20210208 |
| Weintek | cMT-CTRL01 | unspecified – before 20210302 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01 x_refsource_MISC
- https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf x_refsource_CONFIRM