title: Weintek EasyWeb cMT Cross-site Scripting
description: The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.
problem types: CWE-79: Cross-site Scripting
affected:
{
product: cMT-SVR-1xx/2xx
vendor: Weintek
versions:
lessThan: 20210305, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-G01/G02
vendor: Weintek
versions:
lessThan: 20210209, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-G03/G04
vendor: Weintek
versions:
lessThan: 20210222, status: affected, version: unspecified, versionType: custom
}
{
product: cMT3071/cMT3072/cMT3090/cMT3103/cMT3151
vendor: Weintek
versions:
lessThan: 20210218, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-HDM
vendor: Weintek
versions:
lessThan: 20210204, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-FHD
vendor: Weintek
versions:
lessThan: 20210208, status: affected, version: unspecified, versionType: custom
}
{
product: cMT-CTRL01
vendor: Weintek
versions:
lessThan: 20210302, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
]
solutions: Weintek has released OS upgrades for the affected products. Refer to Weintek’s Technical Notice regarding these vulnerabilities.
https://www.weintek.com/globalw/Download/Download.aspx
https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdf