CVE-2021-27446 Weintek EasyWeb cMT Code Injection

Critical 10.0 Published 16 May 2022 Updated 16 Apr 2025

Unauthenticated remote attackers can execute arbitrary commands with root privileges on Weintek cMT HMI devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-27446?

CVE-2021-27446 is a critical code injection vulnerability in Weintek cMT-CTRL01, published on 16 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.

Weakness: CWE-94

Which versions are affected by CVE-2021-27446?

It affects 16 products.

Products include Weintek Cmt-Ctrl01 Firmware, Weintek Cmt-Fhd Firmware, Weintek Cmt-G01 Firmware, Weintek Cmt-G02 Firmware, Weintek Cmt-G03 Firmware, Weintek Cmt-G04 Firmware and 10 more.

How do I fix CVE-2021-27446?

No fix has been published for CVE-2021-27446 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-27446 being exploited?

There is no known exploitation of CVE-2021-27446 in the wild and no public exploit code.

Sources

Also known as GHSA-7r8g-jh99-cmrq.