CVE-2023-40145

EUVD-2023-44752








In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
icscertCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
Affected Products (NVD)
VendorProductVersion
weintekcmt-fhd_firmware
𝑥
< 20210212
weintekcmt-hdm_firmware
𝑥
< 20210206
weintekcmt3071_firmware
𝑥
< 20210220
weintekcmt3072_firmware
𝑥
< 20210220
weintekcmt3090_firmware
𝑥
< 20210220
weintekcmt3103_firmware
𝑥
< 20210220
weintekcmt3151_firmware
𝑥
< 20210220
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf
https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12
https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf
https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12