Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeintek Easybuilder Pro
APPWeintek< 6.07.026.08.01.190 – 6.08.01.614 (excl.)6.08.02 – 6.08.02.500 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2023-0104CRITICAL9.3PL ✓same product
ZipSlip path traversal w Weintek EasyBuilder Pro – przejęcie kontroli nad systemem
CVE-2024-55026CRITICAL9.8PL ✓same vendor
Wykonanie dowolnych poleceń przez endpoint reset_pj.cgi w Weintek cMT-3072XH2
CVE-2024-55020CRITICAL9.8PL ✓same vendor
Command injection z uprawnieniami root w Weintek cMT-3072XH2 easyweb
CVE-2024-55024CRITICAL9.8PL ✓same vendor
Pominięcie uwierzytelniania w Weintek cMT-3072XH2 easyweb — dostęp administracyjny
CVE-2023-38584CRITICAL9.8PL ✓same vendor
Stack-based buffer overflow w Weintek cMT3000 HMI — obejście uwierzytelnienia