EUVD-2026-48747
GHSA-8r5g-w376-c3rg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (icscert) · only source for this CVE.
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
An attacker can modify data that should be restricted to read‑only access.
AnalysisAI
Unauthorized data modification in Weintek EasyWeb allows authenticated low-privilege attackers to alter read‑only data, compromising system integrity. Affected versions are EasyWeb prior to v2.1.20 and cMT3092X firmware prior to 20210218. No active exploitation is known, and low EPSS score indicates limited real‑world risk.
More in Cmt3092X Firmware
View allPrivilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to
Privilege escalation in Weintek cMT3092X HMI allows a low-privileged user to modify authentication tokens, gaining full
Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any netw
Same weakness CWE-286 – Incorrect User Management
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today