Weintek Cmt-Ctrl01 vulnerabilities

CVE-2021-27446 [CRITICAL] CWE-94 CVE-2021-27446: The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated rem The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.

CVE-2025-14751 [HIGH] CWE-620 CVE-2025-14751: A low-privileged user can bypass account credentials without confirming the user's current authentic A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.

CVE-2021-27444 [CRITICAL] CWE-284 CVE-2021-27444: The Weintek cMT product line is vulnerable to various improper access controls, which may allow an u The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.

CVE-2025-14750 [HIGH] CWE-472 CVE-2025-14750: The web application does not sufficiently verify inputs that are assumed to be immutable but are act The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.

CVE-2021-27442 [MEDIUM] CWE-79 CVE-2021-27442: The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allo The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.