Weintek EasyWeb cMT Cross-site Scripting
Priority MEDIUM 50CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0092 60th percentileScored 2026-11-07
Fix Fixed cMT-SVR-1xx/2xx (Weintek): 20210305cMT-G01/G02 (Weintek): 20210209+5 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Weintek | cMT-SVR-1xx/2xx | before 20210305 | 20210305 | Patch available | CNA |
| Weintek | cMT-G01/G02 | before 20210209 | 20210209 | Patch available | CNA |
| Weintek | cMT-G03/G04 | before 20210222 | 20210222 | Patch available | CNA |
| Weintek | cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 | before 20210218 | 20210218 | Patch available | CNA |
| Weintek | cMT-HDM | before 20210204 | 20210204 | Patch available | CNA |
| Weintek | cMT-FHD | before 20210208 | 20210208 | Patch available | CNA |
| Weintek | cMT-CTRL01 | before 20210302 | 20210302 | Patch available | CNA |
- cMT-SVR-1xx/2xx VendorWeintek Affected before 20210305 Fixed in 20210305 Patch available CNA
- cMT-G01/G02 VendorWeintek Affected before 20210209 Fixed in 20210209 Patch available CNA
- cMT-G03/G04 VendorWeintek Affected before 20210222 Fixed in 20210222 Patch available CNA
- cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 VendorWeintek Affected before 20210218 Fixed in 20210218 Patch available CNA
- cMT-HDM VendorWeintek Affected before 20210204 Fixed in 20210204 Patch available CNA
- cMT-FHD VendorWeintek Affected before 20210208 Fixed in 20210208 Patch available CNA
- cMT-CTRL01 VendorWeintek Affected before 20210302 Fixed in 20210302 Patch available CNA
CPE configurations NVD · 32
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:weintek:cmt-svr-100_firmware:*:*:*:*:*:*:*:* | before 20210305 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-svr-100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-svr-102_firmware:*:*:*:*:*:*:*:* | before 20210305 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-svr-102:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-svr-200_firmware:*:*:*:*:*:*:*:* | before 20210305 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-svr-200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-svr-202_firmware:*:*:*:*:*:*:*:* | before 20210305 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-svr-202:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-g01_firmware:*:*:*:*:*:*:*:* | before 20210209 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-g01:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
- cpe:2.3:o:weintek:cmt-svr-100_firmware:*:*:*:*:*:*:*:* Versions before 20210305 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-svr-100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-svr-102_firmware:*:*:*:*:*:*:*:* Versions before 20210305 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-svr-102:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-svr-200_firmware:*:*:*:*:*:*:*:* Versions before 20210305 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-svr-200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-svr-202_firmware:*:*:*:*:*:*:*:* Versions before 20210305 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-svr-202:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-g01_firmware:*:*:*:*:*:*:*:* Versions before 20210209 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-g01:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
Show 22 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:weintek:cmt-g02_firmware:*:*:*:*:*:*:*:* | before 20210209 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-g02:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-g03_firmware:*:*:*:*:*:*:*:* | before 20210222 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-g03:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-g04_firmware:*:*:*:*:*:*:*:* | before 20210222 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-g04:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3071_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3071:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3072_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3072:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3090_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3090:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3103_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3103:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3151_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3151:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-hdm_firmware:*:*:*:*:*:*:*:* | before 20210204 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-hdm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-fhd_firmware:*:*:*:*:*:*:*:* | before 20210208 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-fhd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-ctrl01_firmware:*:*:*:*:*:*:*:* | before 20210302 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-ctrl01:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
- cpe:2.3:o:weintek:cmt-g02_firmware:*:*:*:*:*:*:*:* Versions before 20210209 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-g02:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-g03_firmware:*:*:*:*:*:*:*:* Versions before 20210222 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-g03:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-g04_firmware:*:*:*:*:*:*:*:* Versions before 20210222 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-g04:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3071_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3071:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3072_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3072:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3090_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3090:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3103_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3103:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3151_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3151:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-hdm_firmware:*:*:*:*:*:*:*:* Versions before 20210204 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-hdm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-fhd_firmware:*:*:*:*:*:*:*:* Versions before 20210208 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-fhd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-ctrl01_firmware:*:*:*:*:*:*:*:* Versions before 20210302 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-ctrl01:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
Remediation
- Fix · CNA cMT-SVR-1xx/2xx (Weintek) Fixed in 20210305
- Fix · CNA cMT-G01/G02 (Weintek) Fixed in 20210209
- Fix · CNA cMT-G03/G04 (Weintek) Fixed in 20210222
- Fix · CNA cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 (Weintek) Fixed in 20210218
- Fix · CNA cMT-HDM (Weintek) Fixed in 20210204
- Fix · CNA cMT-FHD (Weintek) Fixed in 20210208
- Fix · CNA cMT-CTRL01 (Weintek) Fixed in 20210302
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Weintek cMT-CTRL01, cMT-FHD and 5 more products 20210204, 20210208 and 5 more versions
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2021-08933 Weintek EasyWeb cMT Code InjectionPriority MEDIUM 54
- TI-2021-08931 Weintek EasyWeb cMT Improper Access ControlPriority MEDIUM 51
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27442
- 2026-10-03 Alias added: GHSA-39vj-8gx7-5cj5
References
More Weintek Cmt-ctrl01 Firmware vulnerabilities
- TI-2021-08933 Weintek EasyWeb cMT Code Injection CVSS 3.1CRITICAL 10.0
- TI-2021-08931 Weintek EasyWeb cMT Improper Access Control CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-27442 · CVE Program
- CVE-2021-27442 · NVD
- FIRST EPSS
- GHSA-39vj-8gx7-5cj5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences