by Kastro
Paper/Archive/CVE-2021-27442

CVE-2021-27442

Weintek cMT-SVR-1xx/2xx — Weintek EasyWeb cMT Cross-site Scripting

EPSS 0.9%CVSS 9.4
critical.is priorityof 100
40
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 60.3.603 × 2012.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.

Affected

ProductAffectedFixed inSource
cMT-SVR-1xx/2xxunspecified – < 2021030520210305CNA
cMT-G01/G02unspecified – < 2021020920210209CNA
cMT-G03/G04unspecified – < 2021022220210222CNA
cMT3071/cMT3072/cMT3090/cMT3103/cMT3151unspecified – < 2021021820210218CNA
cMT-HDMunspecified – < 2021020420210204CNA
cMT-FHDunspecified – < 2021020820210208CNA
cMT-CTRL01unspecified – < 2021030220210302CNA

Scores by source

icscert (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-21-082-01refdl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf