A critical privilege escalation vulnerability in Weintek cMT3092X HMI firmware allows an authenticated, non-privileged user to gain unauthorized elevated access.

The device suffers from improper restriction of operations within the bounds of a memory buffer or object (CWE-732), allowing a low-privileged authenticated user to modify tokens and perform administrative actions.

Successful exploitation allows an attacker to bypass standard authorization controls, potentially leading to full control over the industrial HMI system. Given the CVSS score of 8.8, this poses a high risk to operational technology environments where unauthorized configuration changes could result in safety hazards, process disruption, or permanent equipment damage.

Immediate Action: Obtain and apply the patch package cmt_typeB_20260316_007, which updates EasyWeb to version 2.3.17-typeb, by contacting Weintek support or your local distributor.

Proactive Monitoring: Audit device access logs for unusual administrative activity or unauthorized attempts to modify system tokens.

Compensating Controls: Restrict network access to the HMI device to known, trusted IP addresses using internal firewalls or VLAN segmentation to reduce the attack surface.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk to industrial control systems. Administrators must prioritize the acquisition and application of the provided patch from Weintek to prevent unauthorized privilege escalation and ensure the integrity of the HMI environment.