External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.
External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.
Weintek recommends users implement the following mitigation techniques:
* cMT3072XH: Version 20241112
* cMT3072XH(T): Version 20241112
* cMT-SVRX-820: Version 20240919
* cMT-CTRL01: Version 20250827
For more information, see Weintek's planned notice: https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf
Configurations
Workarounds
Exploits
Credits
finder
Joel Aviad Ossi of WebSec B.V reported these vulnerabilities to CISA.
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service
A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.