by Kastro
Paper/Archive/CVE-2021-27444

CVE-2021-27444

Weintek cMT-SVR-1xx/2xx — Weintek EasyWeb cMT Improper Access Control

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 67.8.678 × 2013.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.

Affected

ProductAffectedFixed inSource
cMT-SVR-1xx/2xxunspecified – < 2021030520210305CNA
cMT-G01/G02unspecified – < 2021020920210209CNA
cMT-G03/G04unspecified – < 2021022220210222CNA
cMT3071/cMT3072/cMT3090/cMT3103/cMT3151unspecified – < 2021021820210218CNA
cMT-HDMunspecified – < 2021020420210204CNA
cMT-FHDunspecified – < 2021020820210208CNA
cMT-CTRL01unspecified – < 2021030220210302CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-21-082-01refdl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf