HighCVSS 8.7
EPSS 0.58%
Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.
Product
Weintek EasyWeb vulnerabilities
13 published CVES affecting Weintek EasyWeb, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 13
- Critical
- 3
- High
- 8
- Medium
- 2
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest Weintek EasyWeb CVEs
Newest publication first
-
-
HighCVSS 8.7 EPSS 0.51%
Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.
-
HighCVSS 7.1 EPSS 0.40%
Weintek cMT3092X HMI stores user account passwords in plaintext.
-
HighCVSS 7.1 EPSS 0.38%
An attacker can modify data that should be restricted to read‑only access.
-
MediumCVSS 6.5 EPSS 0.35%
Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system.
-
HighCVSS 7.5 EPSS 0.39%
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol.
-
MediumCVSS 5.3 EPSS 0.19%
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive information.
-
CriticalCVSS 9.8 EPSS 1.8%
A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges.
-
HighCVSS 8.8 EPSS 1.5%
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter.
-
CriticalCVSS 9.8 EPSS 0.40%
An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request.
-
HighCVSS 7.5 EPSS 0.24%
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db.
-
HighCVSS 7.5 EPSS 0.34%
Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files.
-
CriticalCVSS 9.8 EPSS 0.42%
An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to perform Administrative actions using service accounts.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.