Skip to content
Fencer Intel
critical 10.0

CVE-2021-27446 json

Weintek EasyWeb cMT Code Injection

published 4y ago modified 4mo ago also EUVD-2021-14200

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.0%
EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.

Patch / fix

  • Weintek cMT-SVR-1xx/2xx 20210305
  • Weintek cMT-G01/G02 20210209
  • Weintek cMT-G03/G04 20210222
  • Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 20210218
  • Weintek cMT-HDM 20210204
  • Weintek cMT-FHD 20210208
  • Weintek cMT-CTRL01 20210302

Is CVE-2021-27446 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-21-082-01 updated cvss 10.0

Weintek EasyWeb cMT

  • Weintek cMT-CTRL01 < 20210302 Weintek cMT-FHD < 20210208 Weintek cMT-G01/G02 < 20210209 Weintek cMT-G03/G04 < 20210222 Weintek cMT-HDM < 20210204 Weintek cMT-SVR-1xx/2xx < 20210305
    +1 more products
    Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151 < 20210218
    affected: mitigation “Weintek has released OS upgrades for the affected products. Refer to Weintek's Technical Notice regarding these vulnerabilities.” weintek.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
last yr.

Exploit prediction

2.97% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Weintek cMT-SVR-1xx/2xx
  • Weintek cMT-G01/G02
  • Weintek cMT-G03/G04
  • Weintek cMT3071/cMT3072/cMT3090/cMT3103/cMT3151
  • Weintek cMT-HDM
  • Weintek cMT-FHD
  • Weintek cMT-CTRL01

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.