Vulnerability · Published Oct 19, 2023 · Assigned by icscert

CVE-2023-40145Weintek cMT3000 HMI Web CGI OS Command Injection

High 8.8

In plain English

A high-severity OS command injection in cMT-FHD from Weintek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.5%top 25.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.

Affected products (as reported)

Vendor	Product	Versions
Weintek	cMT-FHD	0 – through 20210210
Weintek	cMT-HDM	0 – through 20210204
Weintek	cMT3071	0 – through 20210218
Weintek	cMT3072	0 – through 20210218
Weintek	cMT3103	0 – through 20210218
Weintek	cMT3090	0 – through 20210218
Weintek	cMT3151	0 – through 20210218

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References