CISA 2026-07-23

Weintek cMT3092X

CVE-2026-60134

Machine-generated analysis · WAYSCloud LLM

Versions of the cMT3092X firmware earlier than 20210218 and EasyWeb earlier than v2.1.20 are vulnerable to privilege escalation via cookie manipulation.

Context

The advisory concerns the Weintek cMT3092X human-machine interface (HMI) and its EasyWeb component. It states that firmware versions prior to 20210218 and EasyWeb versions prior to v2.1.20 allow a non-privileged user to modify cookies and gain elevated privileges, potentially exposing other users’ credentials. The vendor offers a patch (cmt_typeB_20260316_007.patch) that updates EasyWeb to version 2.3.17-typeb. The product is reported as deployed worldwide in critical manufacturing sectors.

Operator considerations

Check: verify that firmware is version 20210218 or newer and EasyWeb is version v2.1.20 or newer.
Patch: apply the cmt_typeB_20260316_007.patch to update EasyWeb to 2.3.17-typeb as recommended by the vendor.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.

The following versions of Weintek cMT3092X are affected:

cMT3092X firmware

Read the full advisory on CISA →