by Kastro
Paper/Archive/CVE-2023-43492

CVE-2023-43492

Weintek cMT-FHD — Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.9.659 × 2013.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.

Affected

ProductAffectedFixed inSource
cMT-FHD≤ 20210210 –CNA
cMT-HDM≤ 20210204 –CNA
cMT3071≤ 20210218–CNA
cMT3072≤ 20210218–CNA
cMT3103≤ 20210218–CNA
cMT3090≤ 20210218–CNA
cMT3151≤ 20210218–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-23-285-12refdl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf