Read the docs
TI-2025-13467 Aliases CVE-2025-14750GHSA-hfxh-j63h-2qhw

External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service

Priority MEDIUM 40CWE-472Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00349 28th percentileScored 2026-11-07
Fix Fixed cMT3072XH (Weintek): 20241112cMT3072XH(T) (Weintek): 20241112+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WeintekcMT3072XH20200630 to before 2024111220241112Patch availableCNA
WeintekcMT3072XH(T)20200630 to before 2024111220241112Patch availableCNA
WeintekcMT-SVRX-82020220413 to before 2024091920240919Patch availableCNA
WeintekcMT-CTRL0120230308 to before 2025082720250827Patch availableCNA
  • cMT3072XH VendorWeintek Affected 20200630 to before 20241112 Fixed in 20241112 Patch available CNA
  • cMT3072XH(T) VendorWeintek Affected 20200630 to before 20241112 Fixed in 20241112 Patch available CNA
  • cMT-SVRX-820 VendorWeintek Affected 20220413 to before 20240919 Fixed in 20240919 Patch available CNA
  • cMT-CTRL01 VendorWeintek Affected 20230308 to before 20250827 Fixed in 20250827 Patch available CNA

Remediation

  • Fix · CNA cMT3072XH (Weintek) Fixed in 20241112
  • Fix · CNA cMT3072XH(T) (Weintek) Fixed in 20241112
  • Fix · CNA cMT-SVRX-820 (Weintek) Fixed in 20240919
  • Fix · CNA cMT-CTRL01 (Weintek) Fixed in 20250827

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Weintek cMT-CTRL01, cMT-SVRX-820 and 2 more products 20240919, 20241112, 20250827

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2025-13468 Unverified Password Change in Weintek cMT X Series HMI EasyWeb ServicePriority MEDIUM 46
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14750
  2. 2026-10-03 Alias added: GHSA-hfxh-j63h-2qhw

References

Other 1

  • TI-2024-36750 An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS… CVSS 3.1CRITICAL 9.8
  • TI-2024-36751 Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in… CVSS 3.1HIGH 7.5
  • TI-2024-36745 Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. CVSS 3.1HIGH 7.5
  • TI-2023-00100 Path traversal in Weintek EasyBuilder Pro cMT CVSS 3.1CRITICAL 9.3
  • TI-2021-08933 Weintek EasyWeb cMT Code Injection CVSS 3.1CRITICAL 10.0
  • TI-2023-19957 Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow CVSS 3.1CRITICAL 9.8
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences