Skip to content
OpenAdvisories
Critical ICSA-23-285-12 3 CVEs

Weintek cMT3000 HMI Web CGI

Published Oct 12, 2023 · Updated Oct 12, 2023

Vendor: Weintek Product: cMT-FHD Product: cMT-HDM Product: cMT3071 Product: cMT3072 Product: cMT3090 Product: cMT3103 Product: cMT3151

Summary

Successful exploitation of these vulnerabilities could allow an attacker to hijack control flow and bypass login authentication or execute arbitrary commands.

Vulnerabilities 3

  • Critical 9.8
    CVE-2023-38584

    Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow

    In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.

    Weintek cMT-FHD cMT-HDM cMT3151
  • Critical 9.8
    CVE-2023-43492

    Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow

    In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.

    Weintek cMT-FHD cMT-HDM cMT3151
  • High 8.8
    CVE-2023-40145

    Weintek cMT3000 HMI Web CGI OS Command Injection

    In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.

    Weintek cMT-HDM cMT-FHD cMT3090

Revision history

  1. #1

    Initial Publication

References