Lucene search

[email protected]CVE-2021-27442

HistoryMay 16, 2022 - 6:15 p.m.

CVE-2021-27442

2022-05-1618:15:08

CWE-79

[email protected]

web.nvd.nist.gov

cve-2021-27442

weintek

cmt

vulnerability

cross-site scripting

javascript code

nvd

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

55.8%

JSON

The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.

Affected configurations

NVD

Node

weintekcmt-svr-100_firmwareRange<20210305

AND

weintekcmt-svr-100Match-

Node

weintekcmt-svr-102_firmwareRange<20210305

AND

weintekcmt-svr-102Match-

Node

weintekcmt-svr-200_firmwareRange<20210305

AND

weintekcmt-svr-200Match-

Node

weintekcmt-svr-202_firmwareRange<20210305

AND

weintekcmt-svr-202Match-

Node

weintekcmt-g01_firmwareRange<20210209

AND

weintekcmt-g01Match-

Node

weintekcmt-g02_firmwareRange<20210209

AND

weintekcmt-g02Match-

Node

weintekcmt-g03_firmwareRange<20210222

AND

weintekcmt-g03Match-

Node

weintekcmt-g04_firmwareRange<20210222

AND

weintekcmt-g04Match-

Node

weintekcmt3071_firmwareRange<20210218

AND

weintekcmt3071Match-

Node

weintekcmt3072_firmwareRange<20210218

AND

weintekcmt3072Match-

Node

weintekcmt3090_firmwareRange<20210218

AND

weintekcmt3090Match-

Node

weintekcmt3103_firmwareRange<20210218

AND

weintekcmt3103Match-

Node

weintekcmt3151_firmwareRange<20210218

AND

weintekcmt3151Match-

Node

weintekcmt-hdm_firmwareRange<20210204

AND

weintekcmt-hdmMatch-

Node

weintekcmt-fhd_firmwareRange<20210208

AND

weintekcmt-fhdMatch-

Node

weintekcmt-ctrl01_firmwareRange<20210302

AND

weintekcmt-ctrl01Match-

CPENameOperatorVersion
weintek:cmt-svr-100_firmwareweintek cmt-svr-100 firmwarelt20210305

CPE	Name	Operator	Version
weintek:cmt-svr-100_firmware	weintek cmt-svr-100 firmware	lt	20210305

CNA Affected

[
  {
    "product": "cMT-SVR-1xx/2xx",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210305",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-G01/G02",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210209",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-G03/G04",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210222",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT3071/cMT3072/cMT3090/cMT3103/cMT3151",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210218",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-HDM",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210204",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-FHD",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210208",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-CTRL01",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210302",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf

www.cisa.gov/uscert/ics/advisories/icsa-21-082-01

Social References

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

55.8%

JSON

Related for CVE-2021-27442

prion1 nvd1 cvelist1 ics2