CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2023-38584

CVSS 9.8v3.1pub. 2023-10-19upd. 2024-11-21

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Weintek Cmt3071

    HW
    Weintek
    all versions

  • Weintek Cmt3071 Firmware

    OS
    Weintek
    < 20210220

  • Weintek Cmt3072

    HW
    Weintek
    all versions

  • Weintek Cmt3072 Firmware

    OS
    Weintek
    < 20210220

  • Weintek Cmt3090

    HW
    Weintek
    all versions

  • Weintek Cmt3090 Firmware

    OS
    Weintek
    < 20210220

  • Weintek Cmt3103

    HW
    Weintek
    all versions

  • Weintek Cmt3103 Firmware

    OS
    Weintek
    < 20210220

  • Weintek Cmt3151

    HW
    Weintek
    all versions

  • Weintek Cmt3151 Firmware

    OS
    Weintek
    < 20210220

  • Weintek Cmt Fhd

    HW
    Weintek
    all versions

  • Weintek Cmt Fhd Firmware

    OS
    Weintek
    < 20210212

  • Weintek Cmt Hdm

    HW
    Weintek
    all versions

  • Weintek Cmt Hdm Firmware

    OS
    Weintek
    < 20210206
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Memory
CWE
References

Related vulnerabilities

CVE-2023-43492CRITICAL9.8PL ✓same product

Stack-based buffer overflow w Weintek cMT3000 HMI — pominięcie uwierzytelnienia

CVE-2021-27442CRITICAL9.4PL ✓same product

XSS w urządzeniach Weintek cMT — wstrzyknięcie złośliwego kodu JavaScript

CVE-2021-27444CRITICAL9.8PL ✓same product

Weintek cMT — Auth Bypass umożliwiający zdalny dostęp i działania administracyjne

CVE-2021-27446CRITICAL10.0PL ✓same product

Code injection z uprawnieniami root w urządzeniach Weintek cMT

CVE-2023-40145HIGH8.8same product

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after l...