by Kastro
Paper/Archive/CVE-2021-27446

CVE-2021-27446

Weintek cMT-SVR-1xx/2xx — Weintek EasyWeb cMT Code Injection

EPSS 3%CVSS 10.0
critical.is priorityof 100
48
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 87.3.873 × 2017.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.

Affected

ProductAffectedFixed inSource
cMT-SVR-1xx/2xxunspecified – < 2021030520210305CNA
cMT-G01/G02unspecified – < 2021020920210209CNA
cMT-G03/G04unspecified – < 2021022220210222CNA
cMT3071/cMT3072/cMT3090/cMT3103/cMT3151unspecified – < 2021021820210218CNA
cMT-HDMunspecified – < 2021020420210204CNA
cMT-FHDunspecified – < 2021020820210208CNA
cMT-CTRL01unspecified – < 2021030220210302CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-21-082-01refdl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf