CVE-2026-61886 Details
Description
Weintek cMT3092X HMI stores user account passwords in plaintext.
A vulnerability exists in the Weintek cMT3092X HMI due to user account passwords being stored in plaintext. This issue affects cMT3092X firmware versions prior to 20210218 and EasyWeb versions prior to v2.1.20. The vulnerability could allow a non-privileged user to view the credentials of other users.
Weintek has released a patch package named cmt_typeB_20260316_007.patch for this vulnerability. Users can request this patch directly from Weintek support or from distributors.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 24, 2026CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-256 | Plaintext Storage of a Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Weintek cMT3092X | < 20210218 < v2.1.20 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |