Lucene search

[email protected]CVE-2021-27446

HistoryMay 16, 2022 - 6:15 p.m.

CVE-2021-27446

2022-05-1618:15:08

CWE-94

[email protected]

web.nvd.nist.gov

weintek

cmt

code injection

remote attacker

root privileges

cve-2021-27446

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

60.3%

JSON

The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.

Affected configurations

NVD

Node

weintekcmt-svr-100Match-

AND

weintekcmt-svr-100_firmwareRange<20210305

Node

weintekcmt-svr-102Match-

AND

weintekcmt-svr-102_firmwareRange<20210305

Node

weintekcmt-svr-200Match-

AND

weintekcmt-svr-200_firmwareRange<20210305

Node

weintekcmt-svr-202Match-

AND

weintekcmt-svr-202_firmwareRange<20210305

Node

weintekcmt-g01Match-

AND

weintekcmt-g01_firmwareRange<20210209

Node

weintekcmt-g02Match-

AND

weintekcmt-g02_firmwareRange<20210209

Node

weintekcmt-g03Match-

AND

weintekcmt-g03_firmwareRange<20210222

Node

weintekcmt-g04Match-

AND

weintekcmt-g04_firmwareRange<20210222

Node

weintekcmt3071_firmwareRange<20210218

AND

weintekcmt3071Match-

Node

weintekcmt3072_firmwareRange<20210218

AND

weintekcmt3072Match-

Node

weintekcmt3090_firmwareRange<20210218

AND

weintekcmt3090Match-

Node

weintekcmt3103_firmwareRange<20210218

AND

weintekcmt3103Match-

Node

weintekcmt3151_firmwareRange<20210218

AND

weintekcmt3151Match-

Node

weintekcmt-hdm_firmwareRange<20210204

AND

weintekcmt-hdmMatch-

Node

weintekcmt-fhd_firmwareRange<20210208

AND

weintekcmt-fhdMatch-

Node

weintekcmt-ctrl01_firmwareRange<20210302

AND

weintekcmt-ctrl01Match-

CPENameOperatorVersion
weintek:cmt-svr-100_firmwareweintek cmt-svr-100 firmwarelt20210305

CPE	Name	Operator	Version
weintek:cmt-svr-100_firmware	weintek cmt-svr-100 firmware	lt	20210305

CNA Affected

[
  {
    "product": "cMT-SVR-1xx/2xx",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210305",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-G01/G02",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210209",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-G03/G04",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210222",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT3071/cMT3072/cMT3090/cMT3103/cMT3151",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210218",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-HDM",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210204",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-FHD",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210208",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "cMT-CTRL01",
    "vendor": "Weintek",
    "versions": [
      {
        "lessThan": "20210302",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf

www.cisa.gov/uscert/ics/advisories/icsa-21-082-01

Social References

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

60.3%

JSON

Related for CVE-2021-27446

prion1 nvd1 cvelist1 ics2