Skip to main content

Easyweb CVE-2024-55025

MEDIUM
Improper Access Control (CWE-284)
2026-03-03 cve@mitre.org
Authentication Bypass Easyweb Cmt 3072xh2 Firmware
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 22:05 vuln.today
CVE Published
Mar 03, 2026 - 20:16 nvd
MEDIUM 6.5

DescriptionCVE.org

Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system.

AnalysisAI

Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system. [CVSS 6.5 MEDIUM]

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects the VNC component of Easyweb. Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Easyweb

View all
CVE-2026-60134 HIGH
8.7 Jul 24

Privilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to

CVE-2026-61892 HIGH
8.7 Jul 24

Privilege escalation in Weintek cMT3092X HMI allows a low-privileged user to modify authentication tokens, gaining full

CVE-2024-55020 CRITICAL
9.8 Mar 03

Command injection in Weintek cMT-3072XH2 HMI DHCP activation. EPSS 0.30%.
CVE-2024-55026 CRITICAL
9.8 Mar 03

Command execution via reset_pj.cgi in Weintek cMT-3072XH2.
CVE-2024-55024 CRITICAL
9.8 Mar 03

Auth bypass in Weintek cMT-3072XH2 authorization mechanism.
CVE-2026-61886 HIGH
7.1 Jul 24

Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any netw
CVE-2026-60135 HIGH
7.1 Jul 24

Unauthorized data modification in Weintek EasyWeb allows authenticated low-privilege attackers to alter read‑only data,

CVE-2024-55022 HIGH
8.8 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerabi
CVE-2024-55021 HIGH
7.5 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. [C
CVE-2024-55019 HIGH
7.5 Mar 03

Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v202310
CVE-2024-55027 HIGH
7.5 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_
CVE-2024-55023 MEDIUM
5.3 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2024-55025 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy