Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service
Priority MEDIUM 46CWE-620Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00395 33rd percentileScored 2026-11-07
Fix Fixed cMT3072XH (Weintek): 20241112cMT3072XH(T) (Weintek): 20241112+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Weintek | cMT3072XH | 20200630 to before 20241112 | 20241112 | Patch available | CNA |
| Weintek | cMT3072XH(T) | 20200630 to before 20241112 | 20241112 | Patch available | CNA |
| Weintek | cMT-SVRX-820 | 20220413 to before 20240919 | 20240919 | Patch available | CNA |
| Weintek | cMT-CTRL01 | 20230308 to before 20250827 | 20250827 | Patch available | CNA |
- cMT3072XH VendorWeintek Affected 20200630 to before 20241112 Fixed in 20241112 Patch available CNA
- cMT3072XH(T) VendorWeintek Affected 20200630 to before 20241112 Fixed in 20241112 Patch available CNA
- cMT-SVRX-820 VendorWeintek Affected 20220413 to before 20240919 Fixed in 20240919 Patch available CNA
- cMT-CTRL01 VendorWeintek Affected 20230308 to before 20250827 Fixed in 20250827 Patch available CNA
Remediation
- Fix · CNA cMT3072XH (Weintek) Fixed in 20241112
- Fix · CNA cMT3072XH(T) (Weintek) Fixed in 20241112
- Fix · CNA cMT-SVRX-820 (Weintek) Fixed in 20240919
- Fix · CNA cMT-CTRL01 (Weintek) Fixed in 20250827
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Weintek cMT-CTRL01, cMT-SVRX-820 and 2 more products 20240919, 20241112, 20250827
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2025-13467 External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb ServicePriority MEDIUM 40
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14751
- 2026-10-03 Alias added: GHSA-g494-r69f-j7vq
References
More Weintek vulnerabilities
- TI-2024-36750 An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS… CVSS 3.1CRITICAL 9.8
- TI-2024-36751 Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in… CVSS 3.1HIGH 7.5
- TI-2024-36745 Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. CVSS 3.1HIGH 7.5
- TI-2023-00100 Path traversal in Weintek EasyBuilder Pro cMT CVSS 3.1CRITICAL 9.3
- TI-2021-08933 Weintek EasyWeb cMT Code Injection CVSS 3.1CRITICAL 10.0
- TI-2023-19957 Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-14751 · CVE Program
- CVE-2025-14751 · NVD
- FIRST EPSS
- GHSA-g494-r69f-j7vq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences