Skip to content
Fencer Vulns
critical 10.0

CVE-2021-27446 json

Weintek EasyWeb cMT Code Injection

published 2022-05-16 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-14200

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.0%
EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.

Patch / fix

  • Weintek cMT-SVR-1xx/2xx 20210305
  • Weintek cMT-G01/G02 20210209
  • Weintek cMT-G03/G04 20210222
  • Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 20210218
  • Weintek cMT-HDM 20210204
  • Weintek cMT-FHD 20210208
  • Weintek cMT-CTRL01 20210302

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-082-01 updated cvss 10.0

Weintek EasyWeb cMT

  • Weintek cMT-CTRL01 < 20210302 Weintek cMT-FHD < 20210208 Weintek cMT-G01/G02 < 20210209 Weintek cMT-G03/G04 < 20210222 Weintek cMT-HDM < 20210204 Weintek cMT-SVR-1xx/2xx < 20210305
    +1 more products
    Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 < 20210218
    affected: mitigation “Weintek has released OS upgrades for the affected products. Refer to Weintek's Technical Notice regarding these vulnerabilities.” weintek.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

2.97% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Weintek cMT-SVR-1xx/2xx
  • Weintek cMT-G01/G02
  • Weintek cMT-G03/G04
  • Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151
  • Weintek cMT-HDM
  • Weintek cMT-FHD
  • Weintek cMT-CTRL01

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.