CVE-2023-38584 Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow

Critical 9.8 Published 19 Oct 2023 Updated 16 Jan 2025

An anonymous attacker can exploit a stack-based buffer overflow in the Web CGI to hijack control flow and bypass login authentication on Weintek HMI devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-38584?

CVE-2023-38584 is a critical memory corruption vulnerability in Weintek cMT-FHD, published on 19 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.

Weakness: CWE-787, CWE-121

Which versions are affected by CVE-2023-38584?

It affects 7 products.

Products include Weintek Cmt-Fhd Firmware, Weintek Cmt-Hdm Firmware, Weintek Cmt3071 Firmware, Weintek Cmt3072 Firmware, Weintek Cmt3090 Firmware, Weintek Cmt3103 Firmware and 1 more.

How do I fix CVE-2023-38584?

No fix has been published for CVE-2023-38584 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-38584 being exploited?

There is no known exploitation of CVE-2023-38584 in the wild and no public exploit code.

Sources

Also known as GHSA-jhg8-2q46-wfq7.