What’s Vulnerable › Vulnerabilities

CVE-2021-27444: Weintek EasyWeb cMT Improper Access Control

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-16 · updated 2026-06-17
• Weakness: CWE-284

Description

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.

Affected products

• Weintek Cmt-Ctrl01 Firmware: before 20210302 — fixed in 20210302
• Weintek Cmt-Fhd Firmware: before 20210208 — fixed in 20210208
• Weintek Cmt-G01 Firmware: before 20210209 — fixed in 20210209
• Weintek Cmt-G02 Firmware: before 20210209 — fixed in 20210209
• Weintek Cmt-G03 Firmware: before 20210222 — fixed in 20210222
• Weintek Cmt-G04 Firmware: before 20210222 — fixed in 20210222
• Weintek Cmt-Hdm Firmware: before 20210204 — fixed in 20210204
• Weintek Cmt-Svr-100 Firmware: before 20210305 — fixed in 20210305
• Weintek Cmt-Svr-102 Firmware: before 20210305 — fixed in 20210305
• Weintek Cmt-Svr-200 Firmware: before 20210305 — fixed in 20210305
• Weintek Cmt-Svr-202 Firmware: before 20210305 — fixed in 20210305
• Weintek Cmt3071 Firmware: before 20210218 — fixed in 20210218
• Weintek Cmt3072 Firmware: before 20210218 — fixed in 20210218
• Weintek Cmt3090 Firmware: before 20210218 — fixed in 20210218
• Weintek Cmt3103 Firmware: before 20210218 — fixed in 20210218
• Weintek Cmt3151 Firmware: before 20210218 — fixed in 20210218

How to fix

Upgrade to a fixed version: Weintek Cmt-Ctrl01 Firmware 20210302; Weintek Cmt-Fhd Firmware 20210208; Weintek Cmt-G01 Firmware 20210209; Weintek Cmt-G02 Firmware 20210209; Weintek Cmt-G03 Firmware 20210222; Weintek Cmt-G04 Firmware 20210222; Weintek Cmt-Hdm Firmware 20210204; Weintek Cmt-Svr-100 Firmware 20210305; Weintek Cmt-Svr-102 Firmware 20210305; Weintek Cmt-Svr-200 Firmware 20210305; Weintek Cmt-Svr-202 Firmware 20210305; Weintek Cmt3071 Firmware 20210218. Check the vendor advisory for mitigations.

References

• https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01
• https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01

Get alerted when CVE-2021-27444 or the next vulnerability affects your stack