Weintek vulnerabilities
Published CVEs affecting Weintek products: 11 record(s), with severity, exploitation and fixes.
CVE-2024-55027
High · 7.5
CWE-312 Mar 3, 2026
Cleartext Storage of Sensitive Information in Weintek Easyweb
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db.
CVE-2024-55026
Critical · 9.8
CWE-256 Mar 3, 2026
An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS…
An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request.
CVE-2024-55025
Medium · 6.5
CWE-284 Mar 3, 2026
Improper Access Control in Weintek Easyweb
Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system.
CVE-2024-55024
Critical · 9.8
CWE-693 Mar 3, 2026
An authentication bypass vulnerability in the authorization mechanism of Weintek…
An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to perform Administrative actions using service accounts.
CVE-2024-55023
Medium · 5.3
CWE-798 Mar 3, 2026
Use of Hard-coded Credentials in Weintek Easyweb
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive information.
CVE-2024-55022
High · 8.8
CWE-94 Mar 3, 2026
Code Injection in Weintek Easyweb
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter.
CVE-2024-55021
High · 7.5
CWE-798 Mar 3, 2026
Use of Hard-coded Credentials in Weintek Easyweb
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol.
CVE-2024-55020
Critical · 9.8
CWE-20 Mar 3, 2026
Improper Input Validation in Weintek Easyweb
A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges.
CVE-2024-55019
High · 7.5
CWE-284 Mar 3, 2026
Improper Access Control in Weintek Easyweb
Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files.
CVE-2025-14751
High · 8.7
CWE-620 Jan 22, 2026
Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service
A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.
CVE-2025-14750
High · 8.7
CWE-472 Jan 22, 2026
External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.