Vulnerabilidades de Weintek
CVEs publicadas que afetam produtos de Weintek: 11 registro(s), com severidade, exploração e correções.
CVE-2024-55027
Alta · 7.5
CWE-312 03/03/2026
Cleartext Storage of Sensitive Information em Weintek Easyweb
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db.
CVE-2024-55026
Crítica · 9.8
CWE-256 03/03/2026
An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS…
An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request.
CVE-2024-55025
Média · 6.5
CWE-284 03/03/2026
Improper Access Control em Weintek Easyweb
Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system.
CVE-2024-55024
Crítica · 9.8
CWE-693 03/03/2026
An authentication bypass vulnerability in the authorization mechanism of Weintek…
An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to perform Administrative actions using service accounts.
CVE-2024-55023
Média · 5.3
CWE-798 03/03/2026
Use of Hard-coded Credentials em Weintek Easyweb
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive information.
CVE-2024-55022
Alta · 8.8
CWE-94 03/03/2026
Code Injection em Weintek Easyweb
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter.
CVE-2024-55021
Alta · 7.5
CWE-798 03/03/2026
Use of Hard-coded Credentials em Weintek Easyweb
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol.
CVE-2024-55020
Crítica · 9.8
CWE-20 03/03/2026
Improper Input Validation em Weintek Easyweb
A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges.
CVE-2024-55019
Alta · 7.5
CWE-284 03/03/2026
Improper Access Control em Weintek Easyweb
Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files.
CVE-2025-14751
Alta · 8.7
CWE-620 22/01/2026
Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service
A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.
CVE-2025-14750
Alta · 8.7
CWE-472 22/01/2026
External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.