OS Command Injection in Weintek products - CVE-2023-40145
Published: October 13, 2023
Vulnerability identifier: #VU81981
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-40145
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
cMT-FHD
cMT-HDM
cMT3071
cMT3072
cMT3103
cMT3090
cMT3151
cMT-HDM
cMT3071
cMT3072
cMT3103
cMT3090
cMT3151
How to mitigate CVE-2023-40145
Install updates from vendor's website.
cMT-FHD - update to 20210211
cMT-HDM - update to 20210205
cMT3071 - update to 20210219
cMT3072 - update to 20210219
cMT3103 - update to 20210219
cMT3090 - update to 20210219
cMT3151 - update to 20210219
cMT-HDM - update to 20210205
cMT3071 - update to 20210219
cMT3072 - update to 20210219
cMT3103 - update to 20210219
cMT3090 - update to 20210219
cMT3151 - update to 20210219