{"id":"CVE-2021-27444","state":"PUBLISHED","title":"Weintek EasyWeb cMT Improper Access Control","description":"The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.","publishedAt":"2022-05-16T17:15:15.597Z","updatedAt":"2025-04-16T16:21:25.289Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"icscert"},"assigner":"icscert","products":["Weintek cMT-SVR-1xx/2xx","Weintek cMT-G01/G02","Weintek cMT-G03/G04","Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151","Weintek cMT-HDM","Weintek cMT-FHD","Weintek cMT-CTRL01"],"affected":[{"vendor":"Weintek","product":"cMT-SVR-1xx/2xx","versions":[{"version":"unspecified","status":"affected","lessThan":"20210305","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-G01/G02","versions":[{"version":"unspecified","status":"affected","lessThan":"20210209","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-G03/G04","versions":[{"version":"unspecified","status":"affected","lessThan":"20210222","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT3071/cMT3072/cMT3090/cMT3103/cMT3151","versions":[{"version":"unspecified","status":"affected","lessThan":"20210218","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-HDM","versions":[{"version":"unspecified","status":"affected","lessThan":"20210204","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-FHD","versions":[{"version":"unspecified","status":"affected","lessThan":"20210208","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-CTRL01","versions":[{"version":"unspecified","status":"affected","lessThan":"20210302","versionType":"custom"}]}],"references":["https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01","https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T19:48:15.637Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/27xxx/CVE-2021-27444.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-27444","state":"PUBLISHED","datePublished":"2022-05-16T17:15:15.597Z","dateUpdated":"2025-04-16T16:21:25.289Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2021-02-19T00:00:00.000Z"},"containers":{"cna":{"title":"Weintek EasyWeb cMT Improper Access Control","descriptions":[{"lang":"en","value":"The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator."}],"affected":[{"vendor":"Weintek","product":"cMT-SVR-1xx/2xx","versions":[{"version":"unspecified","status":"affected","lessThan":"20210305","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-G01/G02","versions":[{"version":"unspecified","status":"affected","lessThan":"20210209","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-G03/G04","versions":[{"version":"unspecified","status":"affected","lessThan":"20210222","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT3071/cMT3072/cMT3090/cMT3103/cMT3151","versions":[{"version":"unspecified","status":"affected","lessThan":"20210218","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-HDM","versions":[{"version":"unspecified","status":"affected","lessThan":"20210204","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-FHD","versions":[{"version":"unspecified","status":"affected","lessThan":"20210208","versionType":"custom"}]},{"vendor":"Weintek","product":"cMT-CTRL01","versions":[{"version":"unspecified","status":"affected","lessThan":"20210302","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01","tags":["x_refsource_MISC"]},{"url":"https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","dateUpdated":"2022-05-16T17:15:15.000Z","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6"},"credits":[{"lang":"en","value":"Marcin Dudek from CERT.PL reported these vulnerabilities to CISA."}],"datePublic":"2021-03-23T00:00:00.000Z","solutions":[{"lang":"en","value":"Weintek has released OS upgrades for the affected products. Refer to Weintek’s Technical Notice regarding these vulnerabilities.\nhttps://www.weintek.com/globalw/Download/Download.aspx\nhttps://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","DATE_PUBLIC":"2021-03-23T17:00:00.000Z","ID":"CVE-2021-27444","STATE":"PUBLIC","TITLE":"Weintek EasyWeb cMT Improper Access Control"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"cMT-SVR-1xx/2xx","version":{"version_data":[{"version_affected":"<","version_value":"20210305"}]}},{"product_name":"cMT-G01/G02","version":{"version_data":[{"version_affected":"<","version_value":"20210209"}]}},{"product_name":"cMT-G03/G04","version":{"version_data":[{"version_affected":"<","version_value":"20210222"}]}},{"product_name":"cMT3071/cMT3072/cMT3090/cMT3103/cMT3151","version":{"version_data":[{"version_affected":"<","version_value":"20210218"}]}},{"product_name":"cMT-HDM","version":{"version_data":[{"version_affected":"<","version_value":"20210204"}]}},{"product_name":"cMT-FHD","version":{"version_data":[{"version_affected":"<","version_value":"20210208"}]}},{"product_name":"cMT-CTRL01","version":{"version_data":[{"version_affected":"<","version_value":"20210302"}]}}]},"vendor_name":"Weintek"}]}},"credit":[{"lang":"eng","value":"Marcin Dudek from CERT.PL reported these vulnerabilities to CISA."}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-284: Improper Access Control"}]}]},"references":{"reference_data":[{"name":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01","refsource":"MISC","url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01"},{"name":"https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf","refsource":"CONFIRM","url":"https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf"}]},"solution":[{"lang":"en","value":"Weintek has released OS upgrades for the affected products. Refer to Weintek’s Technical Notice regarding these vulnerabilities.\nhttps://www.weintek.com/globalw/Download/Download.aspx\nhttps://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf"}],"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T20:48:17.213Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-16T15:54:59.080295Z","id":"CVE-2021-27444","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-16T16:21:25.289Z"}}]}}}