Is there a patch available for CVE-2026-61892?

Yes, a patch is available for CVE-2026-61892. Update the affected software to the latest version immediately.

Cmt3092X Firmware CVE-2026-61892

Q: What is the CVSS score of CVE-2026-61892?

CVE-2026-61892 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48749 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-07-24 icscert

GHSA-f56p-33jj-44h8

Privilege Escalation Cmt3092X Firmware Easyweb

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (icscert) · only source for this CVE.

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 12:03 vuln.today

Patch available

Jul 25, 2026 - 02:17 EUVD

CVSS changed

Jul 24, 2026 - 23:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

Jul 24, 2026 - 22:16 cve.org

HIGH 8.7

DescriptionCVE.org

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

AnalysisAI

Privilege escalation in Weintek cMT3092X HMI allows a low-privileged user to modify authentication tokens, gaining full administrative control over the device. The vulnerability affects firmware prior to 20210218 and EasyWeb prior to v2.1.20. No active exploitation is known and public exploit code has not been identified; EPSS indicates a low likelihood of exploitation.