Weintek cMT3092X HMI patches privilege flaws
Weintek's cMT3092X HMI has four vulnerabilities allowing privilege escalation and plaintext password exposure, fixed via a vendor patch.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an advisory for the Weintek cMT3092X HMI, used in critical manufacturing environments worldwide, detailing four vulnerabilities affecting firmware versions prior to 20210218 and EasyWeb versions prior to v2.1.20. The flaws include cookie manipulation to gain elevated privileges (CVE-2026-60134), token manipulation for privilege escalation (CVE-2026-61892), plaintext storage of user account passwords (CVE-2026-61886), and improper access control allowing modification of read-only data (CVE-2026-60135).
Successful exploitation would allow a non-privileged user to escalate privileges or view credentials belonging to other users, posing a risk to industrial control environments where these HMIs are deployed. Weintek has released a patch package (cmt_typeB_20260316_007.patch) delivering EasyWeb 2.3.17-typeb as a patch-only fix, available through vendor support or distributors, with no separate firmware release planned.
CISA states no known public exploitation of these vulnerabilities has been reported at this time. The issues were responsibly disclosed to CISA by an independent researcher, Vincenzo Giuseppe Colacino of Secoore.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-204-03
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs