Skip to main content

Easyweb EUVDEUVD-2026-48748

| CVE-2026-61886 HIGH
Plaintext Storage of a Password (CWE-256)
2026-07-24 icscert GHSA-hgch-6f8j-3xgx
Information Disclosure Easyweb Cmt3092X Firmware Weintek
7.1
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
7.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (icscert) · only source for this CVE.

CVSS VectorVendor: icscert

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Generated
Jul 26, 2026 - 11:37 vuln.today
Patch available
Jul 25, 2026 - 02:17 EUVD
Severity Changed
Jul 24, 2026 - 23:22 NVD
MEDIUM HIGH
CVSS changed
Jul 24, 2026 - 23:22 NVD
6.5 (MEDIUM) 7.1 (HIGH)
CVE Published
Jul 24, 2026 - 22:10 cve.org
HIGH 7.1

DescriptionCVE.org

Weintek cMT3092X HMI stores user account passwords in plaintext.

AnalysisAI

Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.

More in Easyweb

View all
CVE-2026-60134 HIGH
8.7 Jul 24

Privilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to

CVE-2026-61892 HIGH
8.7 Jul 24

Privilege escalation in Weintek cMT3092X HMI allows a low-privileged user to modify authentication tokens, gaining full

CVE-2024-55020 CRITICAL
9.8 Mar 03

Command injection in Weintek cMT-3072XH2 HMI DHCP activation. EPSS 0.30%.
CVE-2024-55026 CRITICAL
9.8 Mar 03

Command execution via reset_pj.cgi in Weintek cMT-3072XH2.
CVE-2024-55024 CRITICAL
9.8 Mar 03

Auth bypass in Weintek cMT-3072XH2 authorization mechanism.
CVE-2026-60135 HIGH
7.1 Jul 24

Unauthorized data modification in Weintek EasyWeb allows authenticated low-privilege attackers to alter read‑only data,

CVE-2024-55022 HIGH
8.8 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerabi
CVE-2024-55021 HIGH
7.5 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. [C
CVE-2024-55019 HIGH
7.5 Mar 03

Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v202310
CVE-2024-55027 HIGH
7.5 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_
CVE-2024-55025 MEDIUM
6.5 Mar 03

Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized a
CVE-2024-55023 MEDIUM
5.3 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow

Same weakness CWE-256 – Plaintext Storage of a Password

View all
CVE-2024-33375 CRITICAL POC
9.8
CVE-2018-25396 HIGH POC
8.7
CVE-2024-49370 HIGH POC
8.7
CVE-2024-40116 HIGH POC
8.1
CVE-2020-8183 HIGH POC
7.5
CVE-2019-10921 HIGH POC
7.5
CVE-2026-40430 HIGH
8.7
CVE-2024-9418 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-48748 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy