CVE-2023-43492: In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack…

PriorityP264critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.88%

54.5th percentile

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
weintek	cmt-fhd	<= 20210210	—
weintek	cmt-fhd_firmware	< 20210212	20210212
weintek	cmt-hdm	<= 20210204	—
weintek	cmt-hdm_firmware	< 20210206	20210206
weintek	cmt3071	<= 20210218	—
weintek	cmt3071_firmware	< 20210220	20210220
weintek	cmt3072	<= 20210218	—
weintek	cmt3072_firmware	< 20210220	20210220
weintek	cmt3090	<= 20210218	—
weintek	cmt3090_firmware	< 20210220	20210220
weintek	cmt3103	<= 20210218	—
weintek	cmt3103_firmware	< 20210220	20210220
weintek	cmt3151	<= 20210218	—
weintek	cmt3151_firmware	< 20210220	20210220

Detection & IOCsextracted from sources · hover to see the quote

pathcgi-bin/codesys.cgi↗

→Monitor for unauthenticated HTTP requests targeting the codesys.cgi endpoint on Weintek cMT3000 HMI devices, particularly requests with anomalously large or malformed input parameters indicative of a stack-based buffer overflow attempt. ↗
→Also monitor the cgi-bin/command_wb.cgi endpoint for similar unauthenticated oversized input, as a related stack-based buffer overflow (CVE-2023-38584) affects the same device family. ↗

·No known public exploitation has been reported at time of advisory publication; detection posture should still be proactive given the critical CVSS score and ICS context. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.