CVE-2021-27444 Weintek EasyWeb cMT Improper Access Control
Unauthenticated attackers can remotely access sensitive information and perform administrative actions on Weintek cMT devices due to improper access controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27444?
CVE-2021-27444 is a critical missing authorization vulnerability in Weintek cMT-CTRL01, published on 16 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
Weakness: CWE-284
Which versions are affected by CVE-2021-27444?
It affects 16 products.
Products include Weintek Cmt-Ctrl01 Firmware, Weintek Cmt-Fhd Firmware, Weintek Cmt-G01 Firmware, Weintek Cmt-G02 Firmware, Weintek Cmt-G03 Firmware, Weintek Cmt-G04 Firmware and 10 more.
How do I fix CVE-2021-27444?
No fix has been published for CVE-2021-27444 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-27444 being exploited?
There is no known exploitation of CVE-2021-27444 in the wild and no public exploit code.
Other vulnerabilities in Weintek cMT-CTRL01
Sources
Also known as GHSA-f29h-wrwj-qwp2.