CVE-2025-14751 Weintek CVE debrief

Who should care

Industrial control system operators, OT administrators, plant engineers, and security teams managing Weintek cMT X Series HMIs or related EasyWeb deployments should prioritize this issue, especially where management interfaces are reachable from broader networks or shared administrative segments.

Technical summary

The vulnerability is an authentication-state bypass in the EasyWeb Service on affected Weintek devices. According to the advisory, a low-privileged user can bypass account credentials without confirming the current authentication state, enabling unauthorized privilege escalation. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, indicating network accessibility, low attack complexity, and meaningful confidentiality and integrity impact. Affected products in the advisory are cMT3072XH, cMT3072XH(T), cMT-SVRX-820, and cMT-CTRL01.

Defensive priority

High. This is a network-reachable authentication flaw in an OT/HMI service with potential privilege escalation, so affected environments should patch quickly and limit exposure until remediation is complete.

Recommended defensive actions

• Upgrade affected devices to the vendor-fixed versions listed in the advisory: cMT3072XH and cMT3072XH(T) to 20241112, cMT-SVRX-820 to 20240919, and cMT-CTRL01 to 20250827.
• Restrict EasyWeb Service access to trusted management networks only; avoid direct exposure to untrusted or internet-reachable networks.
• Review privileged accounts, role assignments, and recent access logs for unexpected changes or suspicious authentication activity.
• Apply compensating controls if patching is delayed, such as network segmentation, firewall restrictions, and tighter administrative access paths.
• Confirm the affected device inventory includes all Weintek cMT X Series systems that may share the same service or management workflow.

Evidence notes

This debrief is based on CISA’s CSAF advisory ICSA-26-022-05 (published 2026-01-22T07:00:00Z), which names the affected Weintek products and the vendor-fixed versions. The advisory text states that a low-privileged user can bypass account credentials without confirming the user’s current authentication state, leading to unauthorized privilege escalation. The supplied advisory metadata also includes the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. No KEV listing was provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.