What’s Vulnerable › Vulnerabilities

CVE-2021-27442: Weintek EasyWeb cMT Cross-site Scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-16 · updated 2026-06-17
• Weakness: CWE-79

Description

The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.

Affected products

• Weintek Cmt-Ctrl01 Firmware: before 20210302 — fixed in 20210302
• Weintek Cmt-Fhd Firmware: before 20210208 — fixed in 20210208
• Weintek Cmt-G01 Firmware: before 20210209 — fixed in 20210209
• Weintek Cmt-G02 Firmware: before 20210209 — fixed in 20210209
• Weintek Cmt-G03 Firmware: before 20210222 — fixed in 20210222
• Weintek Cmt-G04 Firmware: before 20210222 — fixed in 20210222
• Weintek Cmt-Hdm Firmware: before 20210204 — fixed in 20210204
• Weintek Cmt-Svr-100 Firmware: before 20210305 — fixed in 20210305
• Weintek Cmt-Svr-102 Firmware: before 20210305 — fixed in 20210305
• Weintek Cmt-Svr-200 Firmware: before 20210305 — fixed in 20210305
• Weintek Cmt-Svr-202 Firmware: before 20210305 — fixed in 20210305
• Weintek Cmt3071 Firmware: before 20210218 — fixed in 20210218
• Weintek Cmt3072 Firmware: before 20210218 — fixed in 20210218
• Weintek Cmt3090 Firmware: before 20210218 — fixed in 20210218
• Weintek Cmt3103 Firmware: before 20210218 — fixed in 20210218
• Weintek Cmt3151 Firmware: before 20210218 — fixed in 20210218

How to fix

Upgrade to a fixed version: Weintek Cmt-Ctrl01 Firmware 20210302; Weintek Cmt-Fhd Firmware 20210208; Weintek Cmt-G01 Firmware 20210209; Weintek Cmt-G02 Firmware 20210209; Weintek Cmt-G03 Firmware 20210222; Weintek Cmt-G04 Firmware 20210222; Weintek Cmt-Hdm Firmware 20210204; Weintek Cmt-Svr-100 Firmware 20210305; Weintek Cmt-Svr-102 Firmware 20210305; Weintek Cmt-Svr-200 Firmware 20210305; Weintek Cmt-Svr-202 Firmware 20210305; Weintek Cmt3071 Firmware 20210218. Check the vendor advisory for mitigations.

References

• https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01
• https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01

Get alerted when CVE-2021-27442 or the next vulnerability affects your stack