Answer Brief
CISA advisory ICSA-26-204-03 discloses four vulnerabilities in Weintek cMT3092X HMI firmware, including two critical flaws allowing privilege escalation via cookie and token manipulation, plaintext password storage, and improper user management. All affect firmware versions prior to 20210218 and EasyWeb versions prior to v2.1.20. Weintek has released a patch-only update (cmt_typeB_20260316_007.patch) upgrading EasyWeb to 2.3.17-typeb. No public exploitation has been reported to CISA as of the advisory date. The vulnerabilities collectively undermine authentication and authorization in HMI systems deployed in critical manufacturing environments worldwide.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
CISA publishes ICSA-26-204-03 advisory for Weintek cMT3092X HMI vulnerabilities
- 2
Weintek releases patch package cmt_typeB_20260316_007.patch containing EasyWeb 2.3.17-typeb
- 3
Cutoff date for affected Weintek cMT3092X firmware versions
- 4
Affected Weintek EasyWeb versions released prior to v2.1.20
Executive Summary: CISA advisory ICSA-26-204-03 discloses four vulnerabilities in Weintek cMT3092X HMI firmware, including two critical flaws allowing privilege escalation via cookie and token manipulation, plaintext password storage, and improper user management. All affect firmware versions prior to 20210218 and EasyWeb versions prior to v2.1.20. Weintek has released a patch-only update (cmt_typeB_20260316_007.patch) upgrading EasyWeb to 2.3.17-typeb. No public exploitation has been reported to CISA as of the advisory date. The vulnerabilities collectively undermine authentication and authorization in HMI systems deployed in critical manufacturing environments worldwide.
Why It Matters
The CISA advisory ICSA-26-204-03 reveals a cluster of session management vulnerabilities in the Weintek cMT3092X HMI that collectively expose critical manufacturing environments to significant risk. Two of the flaws—CVE-2026-60134 and CVE-2026-61892—allow non-privileged users to escalate privileges by manipulating cookies and tokens, respectively, both carrying CVSS v3.1 scores of 8.8 (HIGH). These vulnerabilities stem from inadequate validation and integrity checking of web session mechanisms, enabling attackers to bypass authentication controls with low complexity. The other two flaws—CVE-2026-61886 (plaintext password storage, CVSS v3.1 6.5) and CVE-2026-60135 (incorrect user management, CVSS v3.1 6.5)—while rated MEDIUM, compound the risk by exposing credentials and allowing unauthorized modification of read-only data, potentially facilitating lateral movement or privilege abuse post-exploitation. The affected versions—firmware prior to 20210218 and EasyWeb prior to v2.1.20—indicate that these vulnerabilities have persisted in deployments for over five years, raising concerns about the prevalence of unpatched legacy HMI systems in industrial environments. The cMT3092X is deployed globally in critical manufacturing sectors, where HMIs often serve as interfaces to PLCs, SCADA systems, and other OT assets. Exploitation could allow attackers to gain administrative access to the HMI, manipulate industrial processes, steal credentials for lateral movement, or disrupt operations—particularly dangerous in environments where HMIs are trusted components of control loops. Weintek’s response—a patch-only update (cmt_typeB_20260316_007.patch) upgrading EasyWeb to 2.3.17-typeb—suggests the vulnerabilities are confined to the web interface layer rather than the core firmware. This targeted approach allows for faster deployment but places the burden on users to proactively seek and apply the patch via Weintek’s support portal or distributors. The accompanying mitigation document (TEC25003E) provides technical details on the flaws, which organizations should review to understand the exploit conditions and validate patch effectiveness. CISA’s absence of observed public exploitation does not diminish the inherent risk, especially given the high CVSS scores, the device’s global deployment in critical infrastructure, and the likelihood that exploitation may go undetected or unreported. The advisory underscores that HMIs are not merely passive displays but active components of OT networks that require the same rigor in patching, segmentation, and monitoring as PLCs or RTUs. Organizations should prioritize patching internet-facing HMIs, enforce network segmentation between HMI and control layers, monitor for anomalous web traffic to HMI interfaces, and enforce strict access controls until patching is complete. This advisory highlights a broader trend in OT security: legacy web components in industrial devices often inherit vulnerabilities from outdated web frameworks or poor session management practices. For defenders, it reinforces the need to inventory HMI and SCADA web interfaces, assess their exposure, and integrate them into vulnerability management programs. The cMT3092X case serves as a reminder that even perceived peripheral OT devices can become high-impact attack vectors when authentication and authorization controls are weak.
Event Type: security
Importance: high
Affected Companies
- Weintek
Affected Sectors
- Critical Manufacturing
Key Numbers
- CVSS v3.1 Base Score for CVE-2026-60134: 8.8
- CVSS v3.1 Base Score for CVE-2026-61892: 8.8
- CVSS v3.1 Base Score for CVE-2026-61886: 6.5
- CVSS v3.1 Base Score for CVE-2026-60135: 6.5
- CVSS v4.0 Base Score for CVE-2026-60134: 8.7
- CVSS v4.0 Base Score for CVE-2026-61892: 8.7
- CVSS v4.0 Base Score for CVE-2026-61886: 7.1
- CVSS v4.0 Base Score for CVE-2026-60135: 7.1
Timeline
- CISA publishes ICSA-26-204-03 advisory for Weintek cMT3092X HMI vulnerabilities
- Weintek releases patch package cmt_typeB_20260316_007.patch containing EasyWeb 2.3.17-typeb
- Cutoff date for affected Weintek cMT3092X firmware versions
- Affected Weintek EasyWeb versions released prior to v2.1.20
Frequently Asked Questions
What vulnerabilities are disclosed in CISA advisory ICSA-26-204-03 for the Weintek cMT3092X HMI?
The advisory discloses four vulnerabilities: CVE-2026-60134 (cookie manipulation for privilege escalation, CVSS v3.1 8.8), CVE-2026-61892 (token manipulation for privilege escalation, CVSS v3.1 8.8), CVE-2026-61886 (plaintext password storage, CVSS v3.1 6.5), and CVE-2026-60135 (incorrect user management allowing modification of read-only data, CVSS v3.1 6.5). All affect Weintek cMT3092X HMI firmware versions prior to 20210218 and EasyWeb versions prior to v2.1.20.
What patch does Weintek recommend to address the vulnerabilities in the cMT3092X HMI?
Weintek recommends applying the patch package named cmt_typeB_20260316_007.patch, which contains EasyWeb version 2.3.17-typeb. This is a patch-only update; no separate standard firmware release is planned. Users can obtain the patch from Weintek support or authorized distributors via https://www.weintek.com/globalw/Support/Knowledge.aspx.
Has CISA observed public exploitation of these Weintek cMT3092X vulnerabilities?
As of the advisory publication date (2026-07-23), CISA has not received any reports of public exploitation specifically targeting these vulnerabilities. However, the advisory warns that successful exploitation could allow non-privileged users to escalate privileges or view other users' credentials.
Why is the patch for the Weintek cMT3092X HMI delivered as a patch-only update rather than a full firmware release?
Weintek has stated that the fix is delivered as a patch-only update because the vulnerabilities are isolated to the EasyWeb component, and a full firmware release is not planned. The patch (cmt_typeB_20260316_007.patch) upgrades EasyWeb to version 2.3.17-typeb, addressing the specific session management flaws without requiring a broader firmware overhaul.
What mitigations does CISA recommend for organizations unable to immediately apply the patch for the Weintek cMT3092X HMI?
CISA recommends implementing principles of least privilege, avoiding unsolicited email links and attachments, conducting impact analysis and risk assessment before deploying defensive measures, and monitoring for anomalous HMI web traffic. Organizations should also refer to CISA’s ICS webpage for recommended practices, including the technical information paper ICS-TIP-12-146-01B on targeted cyber intrusion detection and mitigation strategies.