Is there a patch available for CVE-2026-60134?

Yes, a patch is available for CVE-2026-60134. Update the affected software to the latest version immediately.

Cmt3092X Firmware CVE-2026-60134

Q: What is the CVSS score of CVE-2026-60134?

CVE-2026-60134 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48750 HIGH

Reliance on Cookies without Validation and Integrity Checking in a Security Decision (CWE-784)

2026-07-24 icscert

GHSA-fgcj-2p5v-hv7f

Information Disclosure Cmt3092X Firmware Easyweb

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (icscert) · only source for this CVE.

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 11:37 vuln.today

Patch available

Jul 25, 2026 - 02:17 EUVD

CVSS changed

Jul 24, 2026 - 23:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

Jul 24, 2026 - 22:20 cve.org

HIGH 8.7

DescriptionCVE.org

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

AnalysisAI

Privilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to gain elevated privileges. Affected firmware versions before 20210218 and EasyWeb versions before v2.1.20 are susceptible, with no public exploit code or active exploitation reported. EPSS probability is low (0.32%), indicating limited real-world exploitation likelihood.