title: Weintek EasyWeb cMT Improper Access Control
description: The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
problem types: CWE-284: Improper Access Control
affected:
{
product: cMT-SVR-1xx/2xx
vendor: Weintek
versions:
lessThan: 20210305, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-G01/G02
vendor: Weintek
versions:
lessThan: 20210209, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-G03/G04
vendor: Weintek
versions:
lessThan: 20210222, status: affected, version: unspecified, versionType: custom
}
{
product: cMT3071/cMT3072/cMT3090/cMT3103/cMT3151
vendor: Weintek
versions:
lessThan: 20210218, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-HDM
vendor: Weintek
versions:
lessThan: 20210204, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-FHD
vendor: Weintek
versions:
lessThan: 20210208, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-CTRL01
vendor: Weintek
versions:
lessThan: 20210302, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Weintek has released OS upgrades for the affected products. Refer to Weintek’s Technical Notice regarding these vulnerabilities.
https://www.weintek.com/globalw/Download/Download.aspx
https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf