Weintek cMT3092X: 4 CVEs, High 8.8
Summary
CISA reports 4 vulnerabilities in Weintek cMT3092X firmware, EasyWeb. Weakness types: Reliance on Cookies without Validation and Integrity Checking in a Security Decision, Incorrect Permission Assignment for Critical Resource, Plaintext Storage of a Password (+1 more). Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users. Highest CVSS v3 score: 8.8 (High), exploitable over the network.
At a glance
- Vendor
- Weintek
- Products
- cMT3092X firmware, EasyWeb
- CVEs
- CVE-2026-60134, CVE-2026-61892, CVE-2026-61886, CVE-2026-60135
- Highest CVSS v3
- 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Taiwan
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-60134 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision | 8.8 | – | No | Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges. |
| CVE-2026-61892 | Incorrect Permission Assignment for Critical Resource | 8.8 | – | No | Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges. |
| CVE-2026-61886 | Plaintext Storage of a Password | 6.5 | – | No | Weintek cMT3092X HMI stores user account passwords in plaintext. |
| CVE-2026-60135 | Incorrect User Management | 6.5 | – | No | An attacker can modify data that should be restricted to read‑only access. |
Affected products (2)
- Weintek cMT3092X firmware: <20210218
- Weintek EasyWeb: <v2.1.20
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors. link
- Mitigation: Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.