Skip to content
OpenAdvisories
High ICSA-26-022-05 2 CVEs

Weintek cMT X Series HMI EasyWeb Service

Published Jan 22, 2026 · Updated Jan 22, 2026

Vendor: Weintek Product: cMT-CTRL01 Product: cMT-SVRX-820 Product: cMT3072XH Product: cMT3072XH(T)

Summary

Successful exploitation of these vulnerabilities could allow a low-level user to alter privileges and gain full control to the device.

Vulnerabilities 2

  • High 8.7
    CVE-2025-14750

    External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service

    The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.

    Weintek cMT-CTRL01 cMT3072XH(T) cMT3072XH
  • High 8.7
    CVE-2025-14751

    Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service

    A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.

    Weintek cMT-CTRL01 cMT3072XH(T) cMT3072XH

Revision history

  1. #1

    Initial Publication

References