2021-02-19 18:00:54 +00:00
{
"CVE_data_meta" : {
2022-05-16 18:01:39 +00:00
"ASSIGNER" : "ics-cert@hq.dhs.gov" ,
"DATE_PUBLIC" : "2021-03-23T17:00:00.000Z" ,
2021-02-19 18:00:54 +00:00
"ID" : "CVE-2021-27444" ,
2022-05-16 18:01:39 +00:00
"STATE" : "PUBLIC" ,
"TITLE" : "Weintek EasyWeb cMT Improper Access Control"
2021-02-19 18:00:54 +00:00
} ,
2022-05-16 18:01:39 +00:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "cMT-SVR-1xx/2xx" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_value" : "20210305"
}
]
}
} ,
{
"product_name" : "cMT-G01/G02" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_value" : " 20210209"
}
]
}
} ,
{
"product_name" : "cMT-G03/G04" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_value" : "20210222"
}
]
}
} ,
{
"product_name" : "cMT3071/cMT3072/cMT3090/cMT3103/cMT3151" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_value" : "20210218"
}
]
}
} ,
{
"product_name" : "cMT-HDM" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_value" : "20210204"
}
]
}
} ,
{
"product_name" : "cMT-FHD" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_value" : "20210208"
}
]
}
} ,
{
"product_name" : "cMT-CTRL01" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_value" : "20210302"
}
]
}
}
]
} ,
"vendor_name" : "Weintek"
}
]
}
} ,
"credit" : [
{
"lang" : "eng" ,
"value" : "Marcin Dudek from CERT.PL reported these vulnerabilities to CISA."
}
] ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
2021-02-19 18:00:54 +00:00
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2022-05-16 18:01:39 +00:00
"value" : "The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator."
2021-02-19 18:00:54 +00:00
}
]
2022-05-16 18:01:39 +00:00
} ,
"generator" : {
"engine" : "Vulnogram 0.0.9"
} ,
"impact" : {
"cvss" : {
"attackComplexity" : "LOW" ,
"attackVector" : "NETWORK" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 9.8 ,
"baseSeverity" : "CRITICAL" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"privilegesRequired" : "NONE" ,
"scope" : "UNCHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" ,
"version" : "3.1"
}
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-284: Improper Access Control"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01" ,
"refsource" : "MISC" ,
"url" : "https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01"
} ,
{
"name" : "https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf" ,
"refsource" : "CONFIRM" ,
"url" : "https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf"
}
]
} ,
"solution" : [
{
"lang" : "eng" ,
"value" : "Weintek has released OS upgrades for the affected products. Refer to Weintek\u2019s Technical Notice regarding these vulnerabilities.\nhttps://www.weintek.com/globalw/Download/Download.aspx\nhttps://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf"
}
] ,
"source" : {
"discovery" : "EXTERNAL"
2021-02-19 18:00:54 +00:00
}
}
