Vendor
Weintek
18 known vulnerabilities.
Weintek at a glance
- Last 12 months
- 6
- Critical · all time
- 7
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 4 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 2 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
High max 8.8ICSA-26-204-03 4 CVEs
Weintek cMT3092X
Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.
-
High max 8.7ICSA-26-022-05 2 CVEs
Weintek cMT X Series HMI EasyWeb Service
Successful exploitation of these vulnerabilities could allow a low-level user to alter privileges and gain full control to the device.
-
Critical max 9.8ICSA-23-306-05 1 CVE
Weintek EasyBuilder Pro
Successful exploitation of this vulnerability could allow an attacker to obtain remote control of a victim's computer as a privileged user.
-
Critical max 9.8ICSA-23-285-12 3 CVEs
Weintek cMT3000 HMI Web CGI
Successful exploitation of these vulnerabilities could allow an attacker to hijack control flow and bypass login authentication or execute arbitrary commands.
-
High max 7.5ICSA-23-199-04 4 CVEs
Weintek Weincloud
Successful exploitation of these vulnerabilities could allow an attacker to utilize the JSON web token (JWT) to reset account passwords, use expired credentials, perform brute force attacks on credentials, or cause a denial-of-service condition.
18 results · Feed
-
High 8.8
Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision
Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.
-
High 8.8
Weintek cMT3092X Incorrect Permission Assignment for Critical Resource
Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.
-
Medium 6.5
Weintek cMT3092X Plaintext Storage of a Password
Weintek cMT3092X HMI stores user account passwords in plaintext.
-
Medium 6.5
Weintek cMT3092X Incorrect User Management
An attacker can modify data that should be restricted to read‑only access.
-
High 8.7
Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service
A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.
-
High 8.7
External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.
-
Critical 9.8
Weintek EasyBuilder Pro Use of Hard-coded Credentials
Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash repo…
-
Critical 9.8
Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow
In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.
-
High 8.8
Weintek cMT3000 HMI Web CGI OS Command Injection
In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.
-
Critical 9.8
Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow
In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication.
-
High 7.2
Weintek Weincloud Improper Authentication
Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website.
-
Medium 5.3
Weintek Weincloud Improper Restriction of Excessive Authentication Attempts
Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses.
-
High 7.5
Weintek Weincloud Improper Handling of Structural Elements
Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.
-
High 7.4
Weintek Weincloud Weak Password Recovery Mechanism for Forgotten Password
Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.
-
Critical 9.3CVE-2023-0104 EPSS 22%
The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious pr…
-
Critical 10.0
Weintek EasyWeb cMT Code Injection
The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.
-
Critical 9.8
Weintek EasyWeb cMT Improper Access Control
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
-
Critical 9.4
Weintek EasyWeb cMT Cross-site Scripting
The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.