CVE-2021-27442 : The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated

The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.

Published 2022-05-16 18:15:08

Updated 2022-05-25 16:22:08

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Exploit prediction scoring system (EPSS) score for CVE-2021-27442

EPSS FAQ

0.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 59 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-27442

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
9.4	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	3.9	5.5	ICS-CERT
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: Low
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2021-27442

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: ics-cert@hq.dhs.gov (Primary)

Products affected by CVE-2021-27442

Weintek » Cmt-svr-100 Firmware
Versions before (<) 20210305
cpe:2.3:o:weintek:cmt-svr-100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-svr-100 » Version: N/A
Weintek » Cmt-svr-102 Firmware
Versions before (<) 20210305
cpe:2.3:o:weintek:cmt-svr-102_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-svr-102 » Version: N/A
Weintek » Cmt-svr-200 Firmware
Versions before (<) 20210305
cpe:2.3:o:weintek:cmt-svr-200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-svr-200 » Version: N/A
Weintek » Cmt-svr-202 Firmware
Versions before (<) 20210305
cpe:2.3:o:weintek:cmt-svr-202_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-svr-202 » Version: N/A
Weintek » Cmt-g01 Firmware
Versions before (<) 20210209
cpe:2.3:o:weintek:cmt-g01_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-g01 » Version: N/A
Weintek » Cmt-g02 Firmware
Versions before (<) 20210209
cpe:2.3:o:weintek:cmt-g02_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-g02 » Version: N/A
Weintek » Cmt-g03 Firmware
Versions before (<) 20210222
cpe:2.3:o:weintek:cmt-g03_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-g03 » Version: N/A
Weintek » Cmt-g04 Firmware
Versions before (<) 20210222
cpe:2.3:o:weintek:cmt-g04_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-g04 » Version: N/A
Weintek » Cmt3071 Firmware
Versions before (<) 20210218
cpe:2.3:o:weintek:cmt3071_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt3071 » Version: N/A
Weintek » Cmt3072 Firmware
Versions before (<) 20210218
cpe:2.3:o:weintek:cmt3072_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt3072 » Version: N/A
Weintek » Cmt3090 Firmware
Versions before (<) 20210218
cpe:2.3:o:weintek:cmt3090_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt3090 » Version: N/A
Weintek » Cmt3103 Firmware
Versions before (<) 20210218
cpe:2.3:o:weintek:cmt3103_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt3103 » Version: N/A
Weintek » Cmt3151 Firmware
Versions before (<) 20210218
cpe:2.3:o:weintek:cmt3151_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt3151 » Version: N/A
Weintek » Cmt-hdm Firmware
Versions before (<) 20210204
cpe:2.3:o:weintek:cmt-hdm_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-hdm » Version: N/A
Weintek » Cmt-fhd Firmware
Versions before (<) 20210208
cpe:2.3:o:weintek:cmt-fhd_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-fhd » Version: N/A
Weintek » Cmt-ctrl01 Firmware
Versions before (<) 20210302
cpe:2.3:o:weintek:cmt-ctrl01_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Weintek » Cmt-ctrl01 » Version: N/A

Vulnerability Details : CVE-2021-27442

Exploit prediction scoring system (EPSS) score for CVE-2021-27442

CVSS scores for CVE-2021-27442

CWE ids for CVE-2021-27442

References for CVE-2021-27442

Products affected by CVE-2021-27442