All CISA Advisories, EN

Weintek cMT X Series HMI EasyWeb Service

View CSAF

Summary

Successful exploitation of these vulnerabilities could allow a low-level user to alter privileges and gain full control to the device.

The following versions of Weintek cMT X Series HMI EasyWeb Service are affected:

  • cMT3072XH (CVE-2025-14750, CVE-2025-14751)
  • cMT3072XH(T) (CVE-2025-14750, CVE-2025-14751)
  • cMT-SVRX-820 (CVE-2025-14750, CVE-2025-14751)
  • cMT-CTRL01 (CVE-2025-14750, CVE-2025-14751)
CVSS Vendor Equipment Vulnerabilities
v3 8.3 Weintek Weintek cMT X Series HMI EasyWeb Service External Control of Assumed-Immutable Web Parameter, Unverified Password Change

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Taiwan

Vulnerabilities

Expand All +

CVE-2025-14750

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.

View CVE Details

Affected Products

Weintek cMT X Series HMI EasyWeb Service
Vendor:
Weintek
Product Version:
Weintek cMT3072XH: >=20200630|<20241112, Weintek cMT3072XH(T): >=20200630|<20241112, Weintek cMT-SVRX-820: >=20220413|<20240919, Weintek cMT-CTRL01: >=20230308|<20250827
Product Status:
known_affected
Remediations



[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

This article has been indexed from All CISA Advisories

Read the original article: