Weintek
28 CVEs across 49 Weintek products. Browse Weintek vulnerabilities, severities, and proof-of-concept exploits.
Weintek products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61892 | High | 8.8 | 2026-07-24 | Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges. |
CVE-2026-61886 | Medium | 6.5 | 2026-07-24 | Weintek cMT3092X HMI stores user account passwords in plaintext. |
CVE-2026-60135 | Medium | 6.5 | 2026-07-24 | An attacker can modify data that should be restricted to read‑only access. |
CVE-2026-60134 | High | 8.8 | 2026-07-24 | Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges. |
CVE-2024-55027 | High | 7.5 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db. |
CVE-2024-55026 | Critical | 9.8 | 2026-03-03 | An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supp… |
CVE-2024-55025 | Medium | 6.5 | 2026-03-03 | Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system. |
CVE-2024-55024 | Critical | 9.8 | 2026-03-03 | An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to per… |
CVE-2024-55023 | Medium | 5.3 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive informat… |
CVE-2024-55022 | High | 8.8 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter. |
CVE-2024-55021 | High | 7.5 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. |
CVE-2024-55020 | Critical | 9.8 | 2026-03-03 | A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute a… |
CVE-2024-55019 | High | 7.5 | 2026-03-03 | Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to dow… |
CVE-2025-14751 | | 2026-01-22 | A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escal… | |
CVE-2025-14750 | | 2026-01-22 | The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can mo… | |
CVE-2023-50466 | High | 8.8 | 2023-12-19 | An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or acc… |
CVE-2023-5777 | Critical | 9.8 | 2023-11-06 | Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the… |
CVE-2023-43492 | Critical | 9.8 | 2023-10-19 | In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hi… |
CVE-2023-40145 | High | 8.8 | 2023-10-19 | In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device. |
CVE-2023-38584 | Critical | 9.8 | 2023-10-19 | In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to h… |
CVE-2023-37362 | High | 7.2 | 2023-07-19 | Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website. |
CVE-2023-35134 | High | 7.4 | 2023-07-19 | Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only. |
CVE-2023-34429 | High | 7.5 | 2023-07-19 | Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token. |
CVE-2023-32657 | Medium | 5.3 | 2023-07-19 | Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error messag… |
CVE-2023-0104 | Critical | 9.3 | 2023-02-22 | The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker… |
CVE-2021-27446 | Critical | 10.0 | 2022-05-16 | The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on th… |
CVE-2021-27444 | Critical | 9.8 | 2022-05-16 | The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sen… |
CVE-2021-27442 | Critical | 9.4 | 2022-05-16 | The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious Ja… |