Login Request a demo
Critical severity · published May 16, 2022
CVE-2021-27446
The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system
9.8
CVSS
3%
EPSS
No
On KEV
Description
The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cmt-ctrl01 Firmware · Weintek
before 20210302 · source: NVD
CF
Cmt-fhd Firmware · Weintek
before 20210208 · source: NVD
CF
Cmt-g01 Firmware · Weintek
before 20210209 · source: NVD
CF
Cmt-g02 Firmware · Weintek
before 20210209 · source: NVD
CF
Cmt-g03 Firmware · Weintek
before 20210222 · source: NVD
CF
Cmt-g04 Firmware · Weintek
before 20210222 · source: NVD
CF
Cmt-hdm Firmware · Weintek
before 20210204 · source: NVD
CF
Cmt-svr-100 Firmware · Weintek
before 20210305 · source: NVD
CF
Cmt-svr-102 Firmware · Weintek
before 20210305 · source: NVD
CF
Cmt-svr-200 Firmware · Weintek
before 20210305 · source: NVD
CF
Cmt-svr-202 Firmware · Weintek
before 20210305 · source: NVD
CF
Cmt3071 Firmware · Weintek
before 20210218 · source: NVD
Affected product
CF
Cmt-ctrl01 Firmware
Weintek
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27446
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27446
Mitigation
https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf
Third Party Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01
More from Cmt-ctrl01 Firmware
9.8
CVE-2021-27444
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information…
6.1
CVE-2021-27442
The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code