Skip to content
Fencer Vulns
critical 9.8

CVE-2021-27444 json

Weintek EasyWeb cMT Improper Access Control

published 2022-05-16 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-14198

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.

Patch / fix

  • Weintek cMT-SVR-1xx/2xx 20210305
  • Weintek cMT-G01/G02 20210209
  • Weintek cMT-G03/G04 20210222
  • Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 20210218
  • Weintek cMT-HDM 20210204
  • Weintek cMT-FHD 20210208
  • Weintek cMT-CTRL01 20210302

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-082-01 updated cvss 9.8

Weintek EasyWeb cMT

  • Weintek cMT-CTRL01 < 20210302 Weintek cMT-FHD < 20210208 Weintek cMT-G01/G02 < 20210209 Weintek cMT-G03/G04 < 20210222 Weintek cMT-HDM < 20210204 Weintek cMT-SVR-1xx/2xx < 20210305
    +1 more products
    Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 < 20210218
    affected: mitigation “Weintek has released OS upgrades for the affected products. Refer to Weintek's Technical Notice regarding these vulnerabilities.” weintek.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

1.18% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Weintek cMT-SVR-1xx/2xx
  • Weintek cMT-G01/G02
  • Weintek cMT-G03/G04
  • Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151
  • Weintek cMT-HDM
  • Weintek cMT-FHD
  • Weintek cMT-CTRL01

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.