CVE-2023-40145

published 2023-10-19

CVE-2023-40145: In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.

Priority P2 61 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
weintek	cmt-fhd	<= 20210210	—
weintek	cmt-fhd_firmware	< 20210212	20210212
weintek	cmt-hdm	<= 20210204	—
weintek	cmt-hdm_firmware	< 20210206	20210206
weintek	cmt3071	<= 20210218	—
weintek	cmt3071_firmware	< 20210220	20210220
weintek	cmt3072	<= 20210218	—
weintek	cmt3072_firmware	< 20210220	20210220
weintek	cmt3090	<= 20210218	—
weintek	cmt3090_firmware	< 20210220	20210220
weintek	cmt3103	<= 20210218	—
weintek	cmt3103_firmware	< 20210220	20210220
weintek	cmt3151	<= 20210218	—
weintek	cmt3151_firmware	< 20210220	20210220

Detection & IOCs extracted from sources · hover to see the quote

path /cgi-bin/command_wb.cgi↗

path /cgi-bin/codesys.cgi↗

• → CVE-2023-40145 is an OS Command Injection (CWE-78) vulnerability in Weintek cMT3000 HMI Web CGI; monitor for unexpected OS command execution originating from CGI processes on affected HMI devices after authenticated sessions are established. ↗
• → Monitor HTTP requests targeting /cgi-bin/command_wb.cgi and /cgi-bin/codesys.cgi on Weintek cMT3000-series HMIs for anomalous or oversized input that may indicate buffer overflow or command injection exploitation attempts. ↗

• · CVE-2023-40145 (OS Command Injection, CVSS 8.8) requires the attacker to be logged in (PR:L), whereas the companion buffer overflow CVEs (CVE-2023-38584, CVE-2023-43492, CVSS 9.8) require no authentication (PR:N); chaining the buffer overflow for auth bypass with this command injection is a realistic attack path. ↗
• · No known public exploitation has been reported at time of advisory publication; however, the vulnerability is remotely exploitable with low attack complexity. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78