CVE-2021-27442

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Weintek	cMT-SVR-1xx/2xx	>= unspecified, < 20210305
Weintek	cMT-G01/G02	>= unspecified, < 20210209
Weintek	cMT-G03/G04	>= unspecified, < 20210222
Weintek	cMT3071/cMT3072/cMT3090/cMT3103/cMT3151	>= unspecified, < 20210218
Weintek	cMT-HDM	>= unspecified, < 20210204
Weintek	cMT-FHD	>= unspecified, < 20210208
Weintek	cMT-CTRL01	>= unspecified, < 20210302

References

https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdfMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01Third Party Advisory, US Government Resource
https://dl.weintek.com/public/Document/TEC/TEC21001E_cMT_EasyWeb_V1_Security_Issues.pdfMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-082-01Third Party Advisory, US Government Resource

Timeline

Published: May 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-274449.8The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely acce CVE-2021-274457.8Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device.CVE-2021-274469.8The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with ro CVE-2021-274479.8Mesa Labs AmegaView version 3.0 is vulnerable to a command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2021-274487.8A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versio CVE-2021-274498.8Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server CVE-2021-274507.8SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which cou CVE-2021-274519.8Mesa Labs AmegaView Versions 3.0 and prior’s passcode is generated by an easily reversible algorithm, which may allow an attacker to gain ac CVE-2021-274527.8The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credenti CVE-2021-274539.8Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an CVE-2021-274547.8The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies th CVE-2021-274555.5Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read while processing project files, which may all