CVE-2021-27444
Weintek EasyWeb cMT Improper Access Control
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 20210305, 20210209, 20210222, 20210218, 20210204, and 2 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Weintek cMT-SVR-1xx/2xx
fixed in 20210305
- Weintek cMT-G01/G02
fixed in 20210209
- Weintek cMT-G03/G04
fixed in 20210222
- Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151
fixed in 20210218
- Weintek cMT-HDM
fixed in 20210204
- Weintek cMT-FHD
fixed in 20210208
- Weintek cMT-CTRL01
fixed in 20210302