Skip to main content

Easyweb EUVDEUVD-2026-48750

| CVE-2026-60134 HIGH
Reliance on Cookies without Validation and Integrity Checking in a Security Decision (CWE-784)
2026-07-24 icscert GHSA-fgcj-2p5v-hv7f
Information Disclosure Easyweb Cmt3092X Firmware Weintek
8.7
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (icscert) · only source for this CVE.

CVSS VectorVendor: icscert

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Jul 26, 2026 - 11:37 vuln.today
Patch available
Jul 25, 2026 - 02:17 EUVD
CVSS changed
Jul 24, 2026 - 23:22 NVD
8.8 (HIGH) 8.7 (HIGH)
CVE Published
Jul 24, 2026 - 22:20 cve.org
HIGH 8.7

DescriptionCVE.org

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

AnalysisAI

Privilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to gain elevated privileges. Affected firmware versions before 20210218 and EasyWeb versions before v2.1.20 are susceptible, with no public exploit code or active exploitation reported. EPSS probability is low (0.32%), indicating limited real-world exploitation likelihood.

More in Easyweb

View all
CVE-2026-61892 HIGH
8.7 Jul 24

Privilege escalation in Weintek cMT3092X HMI allows a low-privileged user to modify authentication tokens, gaining full

CVE-2024-55020 CRITICAL
9.8 Mar 03

Command injection in Weintek cMT-3072XH2 HMI DHCP activation. EPSS 0.30%.
CVE-2024-55026 CRITICAL
9.8 Mar 03

Command execution via reset_pj.cgi in Weintek cMT-3072XH2.
CVE-2024-55024 CRITICAL
9.8 Mar 03

Auth bypass in Weintek cMT-3072XH2 authorization mechanism.
CVE-2026-61886 HIGH
7.1 Jul 24

Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any netw
CVE-2026-60135 HIGH
7.1 Jul 24

Unauthorized data modification in Weintek EasyWeb allows authenticated low-privilege attackers to alter read‑only data,

CVE-2024-55022 HIGH
8.8 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerabi
CVE-2024-55021 HIGH
7.5 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. [C
CVE-2024-55019 HIGH
7.5 Mar 03

Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v202310
CVE-2024-55027 HIGH
7.5 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_
CVE-2024-55025 MEDIUM
6.5 Mar 03

Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized a
CVE-2024-55023 MEDIUM
5.3 Mar 03

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow

Same weakness CWE-784 – Reliance on Cookies without Validation and Integrity Checking in a Security Decision

View all
CVE-2023-3050 CRITICAL POC
9.8
CVE-2020-8184 HIGH POC
7.5
CVE-2024-9820 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-48750 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy