Lucene search

IcscertCVE-2021-27444

HistoryMay 16, 2022 - 6:15 p.m.

CVE-2021-27444

2022-05-1618:15:08

CWE-284

icscert

web.nvd.nist.gov

weintek

cmt

vulnerability

improper access controls

remote access

sensitive information

unauthorized access

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

55.3%

JSON

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.

Affected configurations

Nvd

Node

weintekcmt-svr-100_firmwareRange<20210305

AND

weintekcmt-svr-100Match-

Node

weintekcmt-svr-102_firmwareRange<20210305

AND

weintekcmt-svr-102Match-

Node

weintekcmt-svr-200_firmwareRange<20210305

AND

weintekcmt-svr-200Match-

Node

weintekcmt-svr-202_firmwareRange<20210305

AND

weintekcmt-svr-202Match-

Node

weintekcmt-g01_firmwareRange<20210209

AND

weintekcmt-g01Match-

Node

weintekcmt-g02_firmwareRange<20210209

AND

weintekcmt-g02Match-

Node

weintekcmt-g03_firmwareRange<20210222

AND

weintekcmt-g03Match-

Node

weintekcmt-g04_firmwareRange<20210222

AND

weintekcmt-g04Match-

Node

weintekcmt3071_firmwareRange<20210218

AND

weintekcmt3071Match-

Node

weintekcmt3072_firmwareRange<20210218

AND

weintekcmt3072Match-

Node

weintekcmt3090_firmwareRange<20210218

AND

weintekcmt3090Match-

Node

weintekcmt3103_firmwareRange<20210218

AND

weintekcmt3103Match-

Node

weintekcmt3151_firmwareRange<20210218

AND

weintekcmt3151Match-

Node

weintekcmt-hdm_firmwareRange<20210204

AND

weintekcmt-hdmMatch-

Node

weintekcmt-fhd_firmwareRange<20210208

AND

weintekcmt-fhdMatch-

Node

weintekcmt-ctrl01_firmwareRange<20210302

AND

weintekcmt-ctrl01Match-

VendorProductVersionCPE
weintekcmt-svr-100_firmware*cpe:2.3:o:weintek:cmt-svr-100_firmware:*:*:*:*:*:*:*:*
weintekcmt-svr-100-cpe:2.3:h:weintek:cmt-svr-100:-:*:*:*:*:*:*:*
weintekcmt-svr-102_firmware*cpe:2.3:o:weintek:cmt-svr-102_firmware:*:*:*:*:*:*:*:*
weintekcmt-svr-102-cpe:2.3:h:weintek:cmt-svr-102:-:*:*:*:*:*:*:*
weintekcmt-svr-200_firmware*cpe:2.3:o:weintek:cmt-svr-200_firmware:*:*:*:*:*:*:*:*
weintekcmt-svr-200-cpe:2.3:h:weintek:cmt-svr-200:-:*:*:*:*:*:*:*
weintekcmt-svr-202_firmware*cpe:2.3:o:weintek:cmt-svr-202_firmware:*:*:*:*:*:*:*:*
weintekcmt-svr-202-cpe:2.3:h:weintek:cmt-svr-202:-:*:*:*:*:*:*:*
weintekcmt-g01_firmware*cpe:2.3:o:weintek:cmt-g01_firmware:*:*:*:*:*:*:*:*
weintekcmt-g01-cpe:2.3:h:weintek:cmt-g01:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
weintek	cmt-svr-100_firmware	*	cpe:2.3:o:weintek:cmt-svr-100_firmware::::::::
weintek	cmt-svr-100	-	cpe:2.3:h:weintek:cmt-svr-100:-:::::::*
weintek	cmt-svr-102_firmware	*	cpe:2.3:o:weintek:cmt-svr-102_firmware::::::::
weintek	cmt-svr-102	-	cpe:2.3:h:weintek:cmt-svr-102:-:::::::*
weintek	cmt-svr-200_firmware	*	cpe:2.3:o:weintek:cmt-svr-200_firmware::::::::
weintek	cmt-svr-200	-	cpe:2.3:h:weintek:cmt-svr-200:-:::::::*
weintek	cmt-svr-202_firmware	*	cpe:2.3:o:weintek:cmt-svr-202_firmware::::::::
weintek	cmt-svr-202	-	cpe:2.3:h:weintek:cmt-svr-202:-:::::::*
weintek	cmt-g01_firmware	*	cpe:2.3:o:weintek:cmt-g01_firmware::::::::
weintek	cmt-g01	-	cpe:2.3:h:weintek:cmt-g01:-:::::::*

Rows per page:

1-10 of 321

CNA Affected

[
  {
    "product": "cMT-SVR-1xx/2xx",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210305",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-G01/G02",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210209",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-G03/G04",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210222",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT3071/cMT3072/cMT3090/cMT3103/cMT3151",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210218",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-HDM",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210204",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-FHD",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210208",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-CTRL01",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210302",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf

www.cisa.gov/uscert/ics/advisories/icsa-21-082-01

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

55.3%

JSON

Related for CVE-2021-27444