Lucene search

[email protected]CVE-2021-27442

HistoryMay 16, 2022 - 6:15 p.m.

CVE-2021-27442

2022-05-1618:15:08

CWE-79

[email protected]

web.nvd.nist.gov

cve-2021-27442

weintek

cmt

vulnerability

cross-site scripting

javascript code

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

0.002 Low

EPSS

Percentile

55.9%

JSON

The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.

Affected configurations

NVD

Node

weintekcmt-svr-100_firmwareRange<20210305

AND

weintekcmt-svr-100Match-

Node

weintekcmt-svr-102_firmwareRange<20210305

AND

weintekcmt-svr-102Match-

Node

weintekcmt-svr-200_firmwareRange<20210305

AND

weintekcmt-svr-200Match-

Node

weintekcmt-svr-202_firmwareRange<20210305

AND

weintekcmt-svr-202Match-

Node

weintekcmt-g01_firmwareRange<20210209

AND

weintekcmt-g01Match-

Node

weintekcmt-g02_firmwareRange<20210209

AND

weintekcmt-g02Match-

Node

weintekcmt-g03_firmwareRange<20210222

AND

weintekcmt-g03Match-

Node

weintekcmt-g04_firmwareRange<20210222

AND

weintekcmt-g04Match-

Node

weintekcmt3071_firmwareRange<20210218

AND

weintekcmt3071Match-

Node

weintekcmt3072_firmwareRange<20210218

AND

weintekcmt3072Match-

Node

weintekcmt3090_firmwareRange<20210218

AND

weintekcmt3090Match-

Node

weintekcmt3103_firmwareRange<20210218

AND

weintekcmt3103Match-

Node

weintekcmt3151_firmwareRange<20210218

AND

weintekcmt3151Match-

Node

weintekcmt-hdm_firmwareRange<20210204

AND

weintekcmt-hdmMatch-

Node

weintekcmt-fhd_firmwareRange<20210208

AND

weintekcmt-fhdMatch-

Node

weintekcmt-ctrl01_firmwareRange<20210302

AND

weintekcmt-ctrl01Match-

CPENameOperatorVersion
weintek:cmt-svr-100_firmwareweintek cmt-svr-100 firmwarelt20210305

CPE	Name	Operator	Version
weintek:cmt-svr-100_firmware	weintek cmt-svr-100 firmware	lt	20210305

CNA Affected

[
  {
    "product": "cMT-SVR-1xx/2xx",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210305",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-G01/G02",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210209",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-G03/G04",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210222",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT3071/cMT3072/cMT3090/cMT3103/cMT3151",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210218",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-HDM",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210204",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-FHD",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210208",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-CTRL01",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210302",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf

www.cisa.gov/uscert/ics/advisories/icsa-21-082-01

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

0.002 Low

EPSS

Percentile

55.9%

JSON

Related for CVE-2021-27442

prion1 nvd1 cvelist1 ics2