CVE-2025-14751— Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service
Quick assessment
Affected
Weintek cMT3072XH
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Weintek cMT X Series是中国台湾Weintek公司的一系列智能人机界面。 Weintek cMT X Series存在安全漏洞，该漏洞源于低权限用户可在不确认用户当前身份验证状态的情况下绕过账户凭据，可能导致未经授权的权限提升。以下产品受到影响：cMT3072XH、cMT3072XH(T)、cMT-SVRX-820、cMT-CTRL01。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-14751
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unverified Password Change in Weintek cMT X Series HMI EasyWeb Service
Source: CVE Program / CVE List V5
Vulnerability Description
A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经验证的口令修改
Source: CVE Program / CVE List V5
Vulnerability Title
Weintek cMT X Series 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Weintek cMT X Series是中国台湾Weintek公司的一系列智能人机界面。 Weintek cMT X Series存在安全漏洞，该漏洞源于低权限用户可在不确认用户当前身份验证状态的情况下绕过账户凭据，可能导致未经授权的权限提升。以下产品受到影响：cMT3072XH、cMT3072XH(T)、cMT-SVRX-820、cMT-CTRL01。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Weintek | cMT3072XH | 20200630 ~ 20241112 | - |
|
| Weintek | cMT3072XH(T) | 20200630 ~ 20241112 | - |
|
| Weintek | cMT-SVRX-820 | 20220413 ~ 20240919 | - |
|
| Weintek | cMT-CTRL01 | 20230308 ~ 20250827 | - |
|
II. Public POCs for CVE-2025-14751
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-14751
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: Weintek
-
CVE-2026-60134
Weintek cMT3092X Reliance on Cookies without Validation and -
CVE-2026-61892
Weintek cMT3092X Incorrect Permission Assignment for Critica -
CVE-2026-61886
Weintek cMT3092X Plaintext Storage of a Password -
CVE-2026-60135
Weintek cMT3092X Incorrect User Management -
CVE-2025-14750
External Control of Assumed-Immutable Web Parameter in Weint
Same weakness: CWE-620
-
CVE-2026-92467
microservices-platform through 6.0.0 Unverified Password Cha -
CVE-2026-91995
pig before 4.1.0 Unverified Password Change via /register/pa -
CVE-2026-46623
OpenAM Account Takeover via Unverified Password Change in OA -
CVE-2026-54175
backpack/crud: Unverified password change in MyAccountContro -
CVE-2026-86260
sfturing hosp_order Password Recovery CommonUserController.j
V. Comments for CVE-2025-14751
No comments yet