Weintek cMT3092X

# Weintek HMI Flaws Let Any Low-Level User Seize Full Control of Industrial Touch Panels

## The Threat

When an HMI — a human-machine interface — gets compromised, the blast radius isn't limited to IT. These panels sit between operators and physical infrastructure: conveyor belts, cooling systems, manufacturing lines. The Weintek cMT3092X is exactly this kind of device, and a cluster of newly disclosed vulnerabilities means any authenticated-but-low-privileged user can own it entirely.

The core problem is a trio of interrelated weaknesses in the EasyWeb v2 interface bundled with the cMT3092X firmware. First, the web interface trusts cookies and session tokens without proper validation — meaning a logged-in operator can modify those values client-side and the server accepts the escalated claims at face value. Second, even if an attacker doesn't want to manipulate sessions, they don't need to: user account passwords are stored in plaintext, making credential theft a trivial second path to full access.

All three CVEs share the same attack profile — network-reachable, low complexity, no user interaction required, low privileges needed. That's as close to a turnkey privilege escalation chain as you'll find on industrial equipment. An attacker who starts with a guest-level account on the HMI's web panel can pivot to full administrative control over the device without any sophisticated tooling.

## Severity and Impact

| CVE | CVSS v3.1 Score | CVSS v4.0 Score | Severity | Vector String (v3.1) | CWE |

|---|---|---|---|---|---|

| CVE-2026-60134 | 8.8 | 8.7 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CWE-784 |

| CVE-2026-61892 | 8.8 | 8.7 | HIGH | CVSS:3.1/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-732 |

| CVE-2026-61886 | — | — | HIGH | — | CWE-256 |

Attack Complexity: Low

Authentication Required: Low-privilege account (non-privileged user)

User Interaction: None

Confidentiality / Integrity / Availability Impact: High across all three

## Affected Products

Both components must be updated. The firmware and EasyWeb versions are bundled, so patching one without the other leaves the device exposed.

Deployment scope: Worldwide

Critical sector: Critical Manufacturing

Vendor HQ: Taiwan

## Mitigations

Weintek has released a targeted patch rather than a full firmware update. The fix is delivered as a standalone patch package:

Until the patch is applied, operators should:

1. Restrict network access to the HMI's web interface — firewall or VLAN the EasyWeb port so it is not reachable from untrusted network segments

2. Audit active accounts — because passwords are stored in plaintext, assume any previously granted credentials may be exposed if the device was ever network-accessible

3. Rotate credentials on all accounts immediately if network isolation cannot be confirmed

4. Disable the web interface entirely if remote access isn't operationally required — many HMIs can operate in local-only mode

5. Monitor for anomalous privilege activity on connected systems that the HMI controls or authenticates against

Weintek's full technical bulletin is available at [dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf](https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf).

## References

---

## HackWire Analysis

The combination of flaws here is damning in a specific way: they didn't require a sophisticated attacker to find. Cookie manipulation without server-side validation is a vulnerability class that's been understood since the early 2000s. Plaintext password storage is on every security awareness checklist in existence. The fact that both exist in the same product, in the web interface for an industrial HMI, signals something about how embedded systems vendors have historically treated their web layer — as an afterthought bolted onto hardware that "really" runs on the local panel.

That attitude is increasingly dangerous. Manufacturing environments that spent years air-gapped are now on corporate networks, connected to SCADA systems, sometimes internet-exposed for remote maintenance. The attack surface of an HMI is no longer "physical access only." A threat actor who compromises a contractor's VPN or an operator's workstation now potentially has low-privilege access to EasyWeb — and these CVEs show what they can do from there.

What concerns me more than the technical finding is the patch delivery mechanism. Weintek is distributing the fix as a patch-only update with no standard firmware release, requiring operators to actively request it from support or distributors. That's a friction-heavy remediation path for industrial environments that often run lean IT teams and have strict change windows. In practice, this means a significant percentage of vulnerable devices will stay unpatched for months — not because operators don't care, but because the process makes remediation harder than it needs to be.

Security teams in critical manufacturing should treat this as a forcing function: if you don't have an inventory of your HMI fleet and know which are network-reachable, now is the moment to build one. Patch this device, but use the effort to close the visibility gap that made this advisory land as a surprise.

— HackWire Editorial

---

## Related Coverage