Weintek EasyWeb cMT Improper Access Control
Priority MEDIUM 51CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01184 67th percentileScored 2026-11-07
Fix Fixed cMT-SVR-1xx/2xx (Weintek): 20210305cMT-G01/G02 (Weintek): 20210209+5 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Weintek | cMT-SVR-1xx/2xx | before 20210305 | 20210305 | Patch available | CNA |
| Weintek | cMT-G01/G02 | before 20210209 | 20210209 | Patch available | CNA |
| Weintek | cMT-G03/G04 | before 20210222 | 20210222 | Patch available | CNA |
| Weintek | cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 | before 20210218 | 20210218 | Patch available | CNA |
| Weintek | cMT-HDM | before 20210204 | 20210204 | Patch available | CNA |
| Weintek | cMT-FHD | before 20210208 | 20210208 | Patch available | CNA |
| Weintek | cMT-CTRL01 | before 20210302 | 20210302 | Patch available | CNA |
- cMT-SVR-1xx/2xx VendorWeintek Affected before 20210305 Fixed in 20210305 Patch available CNA
- cMT-G01/G02 VendorWeintek Affected before 20210209 Fixed in 20210209 Patch available CNA
- cMT-G03/G04 VendorWeintek Affected before 20210222 Fixed in 20210222 Patch available CNA
- cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 VendorWeintek Affected before 20210218 Fixed in 20210218 Patch available CNA
- cMT-HDM VendorWeintek Affected before 20210204 Fixed in 20210204 Patch available CNA
- cMT-FHD VendorWeintek Affected before 20210208 Fixed in 20210208 Patch available CNA
- cMT-CTRL01 VendorWeintek Affected before 20210302 Fixed in 20210302 Patch available CNA
CPE configurations NVD · 32
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:weintek:cmt-svr-100_firmware:*:*:*:*:*:*:*:* | before 20210305 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-svr-100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-svr-102_firmware:*:*:*:*:*:*:*:* | before 20210305 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-svr-102:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-svr-200_firmware:*:*:*:*:*:*:*:* | before 20210305 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-svr-200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-svr-202_firmware:*:*:*:*:*:*:*:* | before 20210305 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-svr-202:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-g01_firmware:*:*:*:*:*:*:*:* | before 20210209 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-g01:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
- cpe:2.3:o:weintek:cmt-svr-100_firmware:*:*:*:*:*:*:*:* Versions before 20210305 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-svr-100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-svr-102_firmware:*:*:*:*:*:*:*:* Versions before 20210305 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-svr-102:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-svr-200_firmware:*:*:*:*:*:*:*:* Versions before 20210305 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-svr-200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-svr-202_firmware:*:*:*:*:*:*:*:* Versions before 20210305 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-svr-202:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-g01_firmware:*:*:*:*:*:*:*:* Versions before 20210209 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-g01:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
Show 22 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:weintek:cmt-g02_firmware:*:*:*:*:*:*:*:* | before 20210209 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-g02:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-g03_firmware:*:*:*:*:*:*:*:* | before 20210222 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-g03:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-g04_firmware:*:*:*:*:*:*:*:* | before 20210222 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-g04:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3071_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3071:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3072_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3072:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3090_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3090:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3103_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3103:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt3151_firmware:*:*:*:*:*:*:*:* | before 20210218 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt3151:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-hdm_firmware:*:*:*:*:*:*:*:* | before 20210204 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-hdm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-fhd_firmware:*:*:*:*:*:*:*:* | before 20210208 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-fhd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
| cpe:2.3:o:weintek:cmt-ctrl01_firmware:*:*:*:*:*:*:*:* | before 20210302 | Vulnerable | Weintek |
| cpe:2.3:h:weintek:cmt-ctrl01:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Weintek |
- cpe:2.3:o:weintek:cmt-g02_firmware:*:*:*:*:*:*:*:* Versions before 20210209 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-g02:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-g03_firmware:*:*:*:*:*:*:*:* Versions before 20210222 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-g03:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-g04_firmware:*:*:*:*:*:*:*:* Versions before 20210222 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-g04:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3071_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3071:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3072_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3072:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3090_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3090:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3103_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3103:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt3151_firmware:*:*:*:*:*:*:*:* Versions before 20210218 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt3151:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-hdm_firmware:*:*:*:*:*:*:*:* Versions before 20210204 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-hdm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-fhd_firmware:*:*:*:*:*:*:*:* Versions before 20210208 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-fhd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
- cpe:2.3:o:weintek:cmt-ctrl01_firmware:*:*:*:*:*:*:*:* Versions before 20210302 Vulnerable ·Weintek
- cpe:2.3:h:weintek:cmt-ctrl01:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Weintek
Remediation
- Fix · CNA cMT-SVR-1xx/2xx (Weintek) Fixed in 20210305
- Fix · CNA cMT-G01/G02 (Weintek) Fixed in 20210209
- Fix · CNA cMT-G03/G04 (Weintek) Fixed in 20210222
- Fix · CNA cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 (Weintek) Fixed in 20210218
- Fix · CNA cMT-HDM (Weintek) Fixed in 20210204
- Fix · CNA cMT-FHD (Weintek) Fixed in 20210208
- Fix · CNA cMT-CTRL01 (Weintek) Fixed in 20210302
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Weintek cMT-CTRL01, cMT-FHD and 5 more products 20210204, 20210208 and 5 more versions
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2021-08933 Weintek EasyWeb cMT Code InjectionPriority MEDIUM 54
- TI-2021-08930 Weintek EasyWeb cMT Cross-site ScriptingPriority MEDIUM 50
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27444
- 2026-10-03 Alias added: GHSA-f29h-wrwj-qwp2
References
More Weintek Cmt-ctrl01 Firmware vulnerabilities
- TI-2021-08933 Weintek EasyWeb cMT Code Injection CVSS 3.1CRITICAL 10.0
- TI-2021-08930 Weintek EasyWeb cMT Cross-site Scripting CVSS 3.1CRITICAL 9.4
Sources
- CVE-2021-27444 · CVE Program
- CVE-2021-27444 · NVD
- FIRST EPSS
- GHSA-f29h-wrwj-qwp2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences