10

CVE-2021-27446

Weintek EasyWeb cMT Code Injection

The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Weintek ≫ Cmt-svr-100 Firmware Version < 20210305
   Weintek ≫ Cmt-svr-100 Version -
Weintek ≫ Cmt-svr-102 Firmware Version < 20210305
   Weintek ≫ Cmt-svr-102 Version -
Weintek ≫ Cmt-svr-200 Firmware Version < 20210305
   Weintek ≫ Cmt-svr-200 Version -
Weintek ≫ Cmt-svr-202 Firmware Version < 20210305
   Weintek ≫ Cmt-svr-202 Version -
Weintek ≫ Cmt-g01 Firmware Version < 20210209
   Weintek ≫ Cmt-g01 Version -
Weintek ≫ Cmt-g02 Firmware Version < 20210209
   Weintek ≫ Cmt-g02 Version -
Weintek ≫ Cmt-g03 Firmware Version < 20210222
   Weintek ≫ Cmt-g03 Version -
Weintek ≫ Cmt-g04 Firmware Version < 20210222
   Weintek ≫ Cmt-g04 Version -
Weintek ≫ Cmt3071 Firmware Version < 20210218
   Weintek ≫ Cmt3071 Version -
Weintek ≫ Cmt3072 Firmware Version < 20210218
   Weintek ≫ Cmt3072 Version -
Weintek ≫ Cmt3090 Firmware Version < 20210218
   Weintek ≫ Cmt3090 Version -
Weintek ≫ Cmt3103 Firmware Version < 20210218
   Weintek ≫ Cmt3103 Version -
Weintek ≫ Cmt3151 Firmware Version < 20210218
   Weintek ≫ Cmt3151 Version -
Weintek ≫ Cmt-hdm Firmware Version < 20210204
   Weintek ≫ Cmt-hdm Version -
Weintek ≫ Cmt-fhd Firmware Version < 20210208
   Weintek ≫ Cmt-fhd Version -
Weintek ≫ Cmt-ctrl01 Firmware Version < 20210302
   Weintek ≫ Cmt-ctrl01 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.86% 0.854
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
DHS.gov 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf
Vendor Advisory
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01
Third Party Advisory
US Government Resource