high8.8
CVE-2023-40145
In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.
Impact
In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Weintek | Cmt-Fhd Firmware | before 20210212 |
| Weintek | Cmt-Hdm Firmware | before 20210206 |
| Weintek | Cmt3071 Firmware | before 20210220 |
| Weintek | Cmt3072 Firmware | before 20210220 |
| Weintek | Cmt3090 Firmware | before 20210220 |
| Weintek | Cmt3103 Firmware | before 20210220 |
| Weintek | Cmt3151 Firmware | before 20210220 |
Weakness classification
References
- NVD record
- CVE.org record
- https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12
- https://dl.weintek.com/public/Document/TEC/TEC23005E_cMT_Web_Security_Update.pdf
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-12