CVE-2023-35134

Executive Summary

CVE-2023-35134 is a critical vulnerability in Weintek's Weincloud cloud-based HMI management platform (version 0.13.6 and earlier) that enables an attacker to reset any user's password provided they possess only the corresponding account's JWT (JSON Web Token) token. The vulnerability resides in the password recovery mechanism, which improperly relies on JWT possession as the sole authentication factor without additional verification. Given Weintek's position in the industrial control system (ICS) market, this flaw poses a significant risk to OT environments where Weincloud is used for remote HMI management. A successful exploit results in unauthorized account takeover, potentially granting attackers control over HMI devices in operational technology environments. The vendor has released a fix in account API version 0.13.8, but the patch confidence is rated 2/4, indicating only a single source (the CNA) has confirmed remediation.

Technical Analysis

The Weintek Weincloud platform is a cloud-based service used to remotely manage, monitor, and configure Weintek HMI (Human-Machine Interface) panels in industrial settings. The platform leverages JWT-based authentication, where tokens are issued upon successful login and subsequently used for authorized API interactions.

The vulnerability class is a Weak Password Recovery Mechanism for Forgotten Password, mapping to CWE-640. The NVD description states that Weincloud v0.13.6 "could allow an attacker to reset a password with the corresponding account's JWT token only." This indicates a fundamental flaw in the password reset flow:

1. Authentication Bypass in Recovery Flow: The password reset endpoint in the Weincloud account API accepts a JWT token as the sole proof of identity for resetting an account's password. In a properly designed system, password recovery should require out-of-band verification—such as an email link with a time-limited, single-use code, or a separate recovery token that is distinct from the session token.

2. JWT Token as Sufficient Prover: The affected version does not validate whether the JWT presented during the password reset process was issued with the intent of authorizing a password change. A standard session JWT (issued at login) is indistinguishable from a dedicated password-reset token in this implementation, or the API simply accepts any valid JWT for the target account.

3. Missing Additional Factors: The reset flow omits secondary verification steps (re-entering the current password, email/SMS one-time codes, security questions, or a fresh password-reset token generated via a separate out-of-band channel). This collapses the authentication barrier to possession of any valid JWT for the target account.

Attack Surface: The vulnerability is remotely exploitable over the network without requiring authentication beyond the stolen/forged JWT. The Weincloud service is internet-facing by design, as it provides cloud-based access to HMIs. The attack surface includes the public Weincloud endpoint and the account API (whose exact path is not specified in available data). Because Weincloud connects to on-premise HMI devices, an account takeover can cascade into control-plane access of industrial equipment.

Technical Details from Available Intelligence: The NVD description confirms the following without ambiguity:

• Affected component: Weincloud v0.13.6 (account API)
• Attack precondition: attacker possesses the target account's JWT token
• Attack action: reset the account password
• Result: attacker obtains the new password (or sets it), enabling full account takeover

No specific URL endpoints, parameter names, or function names are disclosed in the NVD description or CNA title. Insufficient technical detail is available regarding the exact implementation of the flawed reset mechanism (e.g., whether it validates JWT expiration, signature, or audience claims incorrectly).

Exploitation Scenarios

Note: No public PoC or exploit code is available for CVE-2023-35134. The attack chain below is inferred strictly from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification The attacker identifies Weintek HMI devices or organization employ Weincloud for remote management. They can do this via:

• Shodan/Censys searches for exposed Weintek HMI panels (which often communicate with Weincloud).
• OSINT gathering on target organizations to identify personnel who may have Weincloud accounts.
• Identifying the Weincloud API endpoint via normal web browsing of the service.

Step 2 — JWT Token Acquisition The critical precondition is possession of the victim account's JWT. Methods to obtain it include:

• Network interception: If the HMI or client communicates over unencrypted or poorly configured channels, an attacker on the same network can capture the JWT.
• XSS or phishing: Compromise an adjacent application connected to Weincloud to steal session tokens.
• Token leakage in logs: JWTs may be inadvertently logged by proxies, reverse proxies, or application logs.
• Default/weak token issuance: If the JWT contains predictable claims (e.g., sequential user IDs) and the signing key is weak or default, the attacker may forge tokens.
• Session hijacking via other vulnerabilities in the Weincloud web interface.

Since the NVD description explicitly states the reset is possible with "the corresponding account's JWT token only," no additional steps (e.g., answering security questions, entering a reset code) are required.

Step 3 — Password Reset Execution Once the attacker possesses the victim's JWT, they:

1. Submit a password reset request to the affected Weincloud account API, presenting the victim's JWT.
2. Because the API accepts the JWT as sufficient proof of identity, the reset proceeds without requiring the current password, an email verification link, or a secondary code.
3. The attacker sets a new password of their choosing for the victim account.

Step 4 — Post-Exploitation Impact

• Full Account Takeover: The attacker now controls the Weincloud account with full privileges.
• HMI Remote Access: If the account is linked to HMI devices via EasyAccess 2.0 or Dashboard services, the attacker can remotely connect to those HMIs, download/upload projects, alter runtime parameters, or push malicious firmware/application images.
• OT Network Pivot: Compromised HMIs serve as a beachhead to reach deeper OT networks (PLCs, SCADA servers, other controllers).
• Persistence: The attacker can create backdoor accounts, modify HMI application logic, or maintain hidden remote access to the devices.
• Ransomware/Extortion: Industrial facilities reliant on Weintek HMIs could face denial-of-service or physical process disruption.

Operational Impact: In a continuous-process facility (e.g., water treatment, energy, manufacturing), an attacker resetting HMI passwords and manipulating device configurations could cause physical damage, safety incidents, or production stoppages.

Impact Assessment

CVSS Score: 7.4 (High) — The vector is derived as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N:

• Attack Vector: Network — remotely exploitable.
• Attack Complexity: Low — condition is simply possessing a valid JWT.
• Privileges Required: None — the attacker does not need valid credentials when the JWT is compromised.
• User Interaction: None — no victim action needed.
• Confidentiality Impact: Low — the attacker gains limited read access from the account takeover itself (moderate exposure of account data).
• Integrity Impact: High — full password reset enables complete modification of account data and downstream system configuration.
• Availability Impact: None — the attack itself does not directly deny service, though subsequent HMI manipulation could.

Business Impact:

1. Critical infrastructure exposure: OT environments where Weintek HMIs are backbones of control systems face a direct, remotely exploitable account takeover path.
2. Regulatory impact: In regulated industries (NERC CIP, ISA/IEC 62443, GDPR for EU), a demonstrated account takeover on industrial systems could trigger compliance violations and fines.
3. Reputational damage: Weintek's credibility as an industrial vendor is questioned when the same token that authenticates a user also authorizes password resets without additional verification.

Blast Radius: The vulnerability propagates across the entire Weincloud multi-tenant service. A single compromised JWT—whether stolen, leaked, or forged—can yield a full account takeover. Since Weincloud manages remote access across multiple HMI devices per account, the blast radius is the set of all HMIs registered to that account.

Exploit in the Wild: No evidence of active exploitation, CISA KEV status is NO. EPSS score of 0.00469 indicates low current exploitation probability (38.4th percentile).

Detection Guidance

The detection rules below target the network traffic (password reset API calls) and client-side behavior that would be observable during exploitation of this vulnerability.

Sigma Rule

title: Weintek Weincloud Password Reset with JWT Only - CVE-2023-35134
id: d3466f27-0001-4e5c-9a40-e9614a228abf
status: experimental
description: Detects password reset requests to Weincloud API that occur without prior account verification. This flags attempts to exploit CVE-2023-35134 where a JWT token is the sole authentication factor for password reset.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-35134
author: Valtersit Threat Intel Team
date: 2024/11/15
logsource:
    category: weblog
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'password/reset'
        c-ip: '-'
    filter_account_recovery_api:
        cs-uri-query|contains: 'email'  # legitimate reset sends email verification
    condition: selection and not filter_account_recovery_api
level: high
falsepositives:
    - Internal legitimate password reset flows that rely solely on JWT (if any).
    - API testing/research tools.
tags:
    - attack.t1190
    - attack.initial-access
    - cve-2023-35134

YARA Rule

rule weincloud_cve_2023_35134_reset_attempt
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects payload patterns attempting password reset in Weintek Weincloud API - CVE-2023-35134"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-35134"
        date = "2024-11-15"
        score = 60
    strings:
        $a = "password" ascii nocase
        $b = "reset" ascii nocase
        $c = "JWT" ascii nocase
        $d = "Authorization" ascii nocase
        $e = "Bearer" ascii nocase
        $f = "reset_password" ascii nocase
    condition:
        (uint16(0) == 0x5B7B or $a or $b) and 2 of them and ($c or $d or $e or $f)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Weintek Weincloud Password Reset via JWT - CVE-2023-35134"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"password"; http.uri; content:"reset"; http.uri; content:"api"; http.header_names; content:"Authorization"; http.header_names; content:"Bearer"; classtype:attempted-admin; reference:cve,2023-35134; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-35134; sid:2023351341; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [ network where event.category == "network" and process.name == "chrome" and
    destination.port == 443 and
    url.path contains "password" and url.path contains "reset" and
    url.path contains "api" and
    http.request.method == "POST" and
    not url.path contains "email" ]
  [ file where event.category == "file" and
    process.name == "chrome" and
    file.name contains "*.json" and file.size > 500 ]

Splunk SPL Query

index=proxy OR index=web
| where method = "POST"
| where uri LIKE "%password%reset%"
| where uri LIKE "%api%"
| where auth_header LIKE "%Bearer%"
| where uri NOT LIKE "%email%"
| table _time, src_ip, dest_ip, uri, auth_header, response_code
| summary

Wazuh OSSEC Rule

<group name="weintek,cve-2023-35134,">
    <rule id="100351" level="12">
        <decoded_as>json</decoded_as>
        <field name="method">POST</field>
        <field name="url">\.*password\.*reset\.*</field>
        <match>JWT|Bearer|Authorization</match>
        <description>Possible CVE-2023-35134 exploitation attempt against Weintek Weincloud - password reset via JWT token only</description>
        <group>weintek,cve-2023-35134,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source [CNA] claims patch; not independently confirmed).

Immediate Mitigations (before patch application):

1. Immediately rotate all JWT tokens for Weincloud accounts to invalidate any previously stolen tokens.
2. Enforce Multi-Factor Authentication (MFA) on all Weincloud accounts at the provider level, even though the underlying vulnerability may bypass it in the reset flow—force users to re-authenticate with MFA immediately after a password change.
3. Monitor authentication logs for anomalous password reset activity — multiple resets in a short window, resets from unusual IPs, resets for privileged/administrator accounts.
4. Log out of all sessions for any account that previously used the service.
5. Restrict network access to the Weincloud service—allowlist only the minimum required public IPs and implement egress filtering for any HMI outbound connections.

Patch / Upgrade Steps:

1. The vendor states Weincloud account API v0.13.8 fixes the issue and requires no user action. Verify in the Weincloud dashboard that the account API version is ≥ 0.13.8.
2. If the version cannot be confirmed as ≥ 0.13.8, contact Weintek support to confirm the rolling upgrade is complete for your tenant.
3. After the vendor confirms the fix, re-test password recovery flows to ensure the JWT-only reset path is disabled and e-mail/SMS verification is now required.

Long-Term Hardening:

1. Disable Weincloud/EasyAccess 2.0/Dashboard if unused — the vendor explicitly recommends removing internet exposure for HMIs that do not require remote access.
2. Segment OT and IT networks — ensure HMI devices are in a DMZ zone with restrictive firewall rules, isolated from the general corporate LAN.
3. Implement Network Intrusion Detection (Suricata/Snort) at the OT perimeter to monitor for abnormal API calls to Weincloud endpoints.
4. Regularly audit HMI project files for unauthorized changes.
5. Substitute corporate SSO if available — integrate Weincloud with a central identity provider that enforces MFA, conditional access policies, and device compliance checks.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-35134
2. Weintek Official Security Advisory (referenced via CNA/CVE data): Patch to account API v0.13.8 — no independent copy available from NVD data.
3. CWE-640 — Weak Password Recovery Mechanism for Forgotten Password: https://cwe.mitre.org/data/definitions/640.html
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild activity have been publicly documented for CVE-2023-35134 as of the date of this report. The CISA Known Exploited Vulnerabilities (KEV) catalog does not list this CVE. Organizations should monitor for updated vendor advisories and independent patch confirmations, given the low patch confidence (2/4).