CVE-2026-60135

Executive Summary

CVE-2026-60135 is an incorrect user management vulnerability in the Weintek cMT3092X industrial HMI (Human-Machine Interface) device, specifically within its EasyWeb web server component. An authenticated low-privileged attacker can exploit this flaw to modify data that the system intends to restrict to read-only access, thereby bypassing the intended authorization model. The vulnerability carries a CVSS v3.1 base score of 6.5 (High) with a network attack vector and high impact on data integrity, making it a significant concern for industrial control system (ICS) environments where HMI integrity is critical. Weintek has issued a patch package (cmt_typeB_20260316_007.patch) containing EasyWeb 2.3.17-typeb, though patch availability is currently based on a single-source claim and should be independently verified.

Technical Analysis

The vulnerability resides in the user management and authorization logic of the EasyWeb web interface embedded in the Weintek cMT3092X HMI. CWE-286 (Incorrect User Management) indicates that the application fails to properly enforce role-based access control (RBAC) or permission boundaries after user authentication. The core flaw is that the server-side access control checks are inconsistent — the system clearly distinguishes between read-only and read-write operations, but fails to enforce write prevention for read-only users on certain data objects.

Vulnerability Mechanism: The EasyWeb interface exposes RESTful or CGI-style endpoints that handle data modification (e.g., setting tag values, modifying recipes, altering alarm configurations, or updating screen variables). The authentication layer successfully validates user credentials and assigns a privilege level; however, the authorization middleware that gates write operations fails to reject requests from accounts with read-only privileges for a subset of these endpoints. This is likely due to incomplete permission checks on certain routes, or a shared handler function that skips the role validation logic for specific data types (e.g., floating-point tags or internal registers).

Attack Surface: The cMT3092X is an industrial HMI designed for operator interface in manufacturing, energy, and infrastructure environments. The EasyWeb feature provides remote browser-based access to screen monitoring and control. The web server listens on standard HTTP port 80 (and optionally 443) and is intended to be reachable over plant networks. The attack surface is further expanded by the fact that many HMI deployments are exposed directly to corporate IT networks with insufficient segmentation.

Root Cause Hypothesis: Analysis of the CWE-286 category and the NVD description ("An attacker can modify data that should be restricted to read-only access") suggests the issue is a missing if (user.role == READ_ONLY) { reject; } guard on certain 'set' endpoints. The vendor's fix — shipping a newer EasyWeb version (2.3.17-typeb) — implies a web application layer fix that adds proper role enforcement across all write handlers, confirming the flaw is in the HTTP handler logic rather than in the underlying firmware kernel or PLC communication stack.

Severity is somewhat tempered by the PreRole requirement (PR:L), meaning the attacker must first possess valid low-privileged credentials. However, default HMI credentials are frequently left unmodified in production, and the network attack vector (AV:N) means any reachable instance is exploitable.

Exploitation Scenarios

Scenario 1: Recipe / Setpoint Tampering Attack Chain

1. Reconnaissance: An attacker scans the OT network subnet (e.g., 10.10.2.0/24) using Shodan or Nmap for port 80/443 banners containing "EasyWeb" or "Weintek." Fingerprinting identifies the device as a cMT3092X. The login page at / is confirmed reachable.

2. Credential Acquisition: The attacker attempts default credentials (e.g., admin/admin for a read-only user variant, or brute-forces a low-privilege operator account using a small wordlist of common HMI passwords). Successful login returns a session cookie with a role token (e.g., role=viewer).

3. Trigger/Weaponization: The attacker intercepts a legitimate read-only request through Burp Suite to map the API endpoints. They observe that GET /api/tag/value?name=Temp_Setpoint perfectly returns a value, but they notice the web UI disables the input field. Switching from the UI to direct API manipulation, the attacker crafts a POST /api/tag/set request with a JSON body containing "name":"Temp_Setpoint","value":75 and forwards it with the read-only session cookie.

4. Payload/Execution: The vulnerable handler processes the write request without enforcing the role check. The state change is executed — the setpoint tag in the HMI's industrial protocol transfer buffer (e.g., Modbus TCP or proprietary Weintek protocol) is updated, causing the controller to receive a new target value.

5. Post-Exploitation Impact: The attacker modifies multiple setpoints (e.g., shift production quality parameters outside specification, trigger safety limit excursions, or change batching logic). Since the HMI logs the write as coming from a legitimate session, forensic attribution is corrupted. If the attacker modifies alarm thresholds, they can blind operators to real process conditions.

Scenario 2: Configuration File / Screen Modification

1. Reconnaissance: The attacker identifies the cMT3092X and authenticates as a read-only monitoring account (often provisioned for QA observers).

2. Weaponization: They access GET /config/screens.xml to enumerate screen names. The attacker crafts an upload request to POST /config/screen with an XML payload that reorders alarm display screens — embedding a phishing-like message ("System Upgrading — Credentials required") on the main operator screen.

3. Execution: The write is accepted despite read-only permission. The modified screen is pushed to the HMI display panel, showing Social Engineering content to the operator.

4. Impacts: Operator confusion leads them to type credentials into a fake dialog, which the attacker then harvests from memory logs, escalating to full administrative control of the HMI.

Scenario 3: Alarm Configuration Corruption (Denial of View)

1. The attacker, using read-only operator account, sends POST /api/alarm with "action":"disable","alarm_id":"1102".

2. Successful response {"status":"ok"} confirms alarm disable. The attacker disables all critical process alarms while leaving the HMI reporting "all systems normal."

3. A subsequent physical process upset (overpressure, temperature excursion) is not reflected to any operator, creating an unsafe state and potential physical equipment damage — meeting the definition of a high integrity impact (I:H) in the CVSS score.

Impact Assessment

CVSS Context: The vulnerability scores 6.5 (High) — specifically with A:C (integrity High). The confidentiality impact is None (C:N) and availability is None (A:N), meaning the flaw neither leaks information nor causes denial of service. The vector AV:N/AC:L/PR:L/UI:N/S:U indicates any unauthenticated session is not sufficient; an attacker needs valid low-level credentials (e.g., a viewer account), but no user interaction and no special conditions skew the score.

Business Impact: Exploitation of this CVE enables an attacker to silently corrupt process data viewed and relied upon by HMI operators. In ICS contexts, the integrity of displayed data is the foundation of safe manual operation. A compromised read-only role can:

• Alter set/target values to drive actuators into unsafe ranges.
• Disable safety interlocks or alarm notifications.
• Modify recipes in process control sequences.
• Tamper with batch logs, undermining compliance and audit trails.

Blast Radius: The cMT3092X is a mid-high performance HMI used in applications like water treatment, packaging machinery, semiconductor fabs, and critical infrastructure. All data transferred to PLCs (Siemens, Allen Bradley, Modbus, CODESYS) passing through the HMI is potentially affected. Since the attacker can modify any writeable tag, the blast radius extends to any downstream machine that reads those values — not just the HMI panel itself.

Confidentiality & Availability are not directly compromised, meaning this is a precision integrity attack — the attacker can decouple operators from reality without generating detection alerts such as system crashes or errors. This stealth makes it particularly dangerous for long-dwell industrial espionage/sabotage campaigns.

Detection Guidance

Sigma Rule

title: Weintek cMT3092X Read-Only Write Bypass - API Modification Activity
id: 7e9b1c22-4f8e-4e6a-9c3d-5d0a1f1b2c4e
status: experimental
description: Detects write attempts via EasyWeb API from users with read-only privileges on Weintek cMT3092X HMI.
logsource:
  category: webserver
  product: httpd
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains:
      - '/api/tag/set'
      - '/api/alarm'
      - '/config/screen'
      - '/api/recipe'
    cs-username|exists: true
    role-token|contains:
      - 'viewer'
      - 'readonly'
      - 'observer'
  condition: selection
falsepositives:
  - A legitimate network misconfiguration where a read-only role is granted write access by an admin
  - Normal API usage if the HMI vendor internally renames roles
level: high

YARA Rule

rule Weintek_cMT3092X_ReadOnly_WriteBypass {
    meta:
        author = "Valkey Security"
        description = "Detect HTTP payloads attempting to bypass read-only restrictions on Weintek cMT3092X"
        date = "2026-07-22"
    strings:
        $s1 = "POST /api/tag/set" ascii wide nocase
        $s2 = "role=readonly" ascii wide nocase
        $s3 = "role=viewer" ascii wide nocase
        $s4 = "value=" ascii wide nocase
        $s5 = "/api/alarm" ascii wide nocase
        $s6 = "/config/screen" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and
        any of ($s4, $s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Weintek cMT3092X Read-Only Write Bypass Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/api/tag/set"; http_uri; content:"Cookie|3a| "; http_header; pcre:"/role=(viewer|read|readonly|observer)/Ui"; content:"value="; http_client_body; sid:6020135; rev:1; metadata:created_at 2026_07_22, cve CVE-2026-60135, severity high;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5s
  [authentication where user.name != null and
     agent.name == "weintek-hmi" and event.outcome == "success"]
  [http where request.method == "POST" and
     url.path == "/api/tag/set" or
     url.path == "/api/alarm" or
     url.path == "/api/recipe" or
     url.path == "/config/screen"
  ]
  [process where evt.type == "start" and 
     process.args == "role_role=readonly" or process.args == "role_role=viewer"]

Note for Elastic: Replace user.name with the actual field mapping from your HMI's session logging. The EQL above assumes the HMI logs its own sessions.

Splunk SPL Query

index=web sourcetype=weintek_easyweb
  | where method="POST" AND (uri="/api/tag/set" OR uri="/api/alarm" OR uri="/api/recipe" OR uri="/config/screen")
  | rename session_role as role
  | search role IN ("viewer", "readonly", "observer", "reader")
  | table _time, src_ip, user, role, uri, status
  | sort - _time
  | eval severity="high"
  | outputcsv cve_2026_60135_attempts.csv

Wazuh OSSEC Rule

<group name="weintek,">
  <rule id="602135" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="uri">\./api/tag/set</field>
    <field name="role">readonly|viewer|observer</field>
    <description>Weintek cMT3092X: read-only user attempted write operation - CVE-2026-60135</description>
    <group>attack.t1548,</group>
  </rule>
  <rule id="602136" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="uri">\./api/alarm</field>
    <field name="role">readonly|viewer|observer</field>
    <description>Weintek cMT3092X: read-only user attempted alarm change - CVE-2026-60135</description>
    <group>attack.t1548,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment: 2/4 — the vendor (via CNA) claims the patch package cmt_typeB_20260316_007.patch resolves the issue, but this is a single-source claim and has not been independently verified by a third party. Security teams should validate the patch version (EasyWeb 2.3.17-typeb) on a test device before production deployment. A MITRE-style confidence score of 2/4 means there is a "somewhat reliable" but not fully confirmed fix.

Immediate Mitigations (no patch applied):

1. Network Isolation: Place all cMT3092X HMIs behind an OT firewall; restrict HTTP/HTTPS access to only trusted engineering workstations and operator stations. Block inbound access from IT zones to the HMI subnet.
2. Credential Hygiene: Immediately force password change for all default accounts. Enforce a strict password policy and suspend any unused low-privileged accounts.
3. Role Review: Audit all accounts on the HMI. Ensure the default admin account does not share a password with guest/viewer accounts. Terminate any read-only user that does not have an explicit business need.
4. Disable Remote Login: If the EasyWeb interface is not needed for operations, disable it entirely at the device level (e.g., via the System Setting on the HMI panel).

Patch/Upgrade Steps:

1. Contact Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or a local distributor to obtain the patch package cmt_typeB_20260316_007.patch.
2. Back up the HMI's current project configuration.
3. Apply the patch using the vendor's update utility (typically via USB or network connection). Reboot the device.
4. Verify the EasyWeb version string reads "2.3.17-typeb" after update.
5. Test that read-only accounts can no longer write data by repeating the PoC steps (login as viewer, attempt POST /api/tag/set).
6. Confirm all existing data tags, recipes, and alarm configurations remain intact post-update.

Long-Term Hardening:

• Implement network-level sniffing of HMI traffic using a passive monitoring appliance (e.g., TAP) to detect abnormal POST requests regardless of patch status.
• Integrate the HMI's logs (if available) with an SIEM to track authorization failures and unusual API calls.
• Enforce a mandatory change-control process for all HMI configuration changes.
• Segment OT networks per ISA/IEC 62443 zones and conduits; HMIs should not be directly routable from enterprise networks.
• Review the vendor advisory on a regular basis, as the patch confidence may improve with independent confirmation; if the patch is later found to be incomplete, re-evaluate.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-60135
2. Weintek Support / Advisory: https://www.weintek.com/globalw/Support/Knowledge.aspx
3. Weintek Product Page (cMT3092X): https://www.weintek.com/globalw/Product/HMI/cMT3092X.aspx
4. MITRE ATT&CK Tactic Mapping: T1548 — Abuse Elevation Control Mechanism
5. EPSS Score Data: https://www.first.org/epss/ (CVE-2026-60135: 0.00213, 11.8% percentile)

Threat Actor Campaigns / Exploit-in-the-Wild: As of the intelligence cutoff date, CVE-2026-60135 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. There are no confirmed reports of this vulnerability being exploited in the wild. The PoC status is "Public" only in the sense that the vulnerability description and CVSS details are publicly disclosed; no public exploit code or weaponized Nuclei template exists. However, security teams should not underestimate the risk, as the attack pattern (default creds + missing RBAC checks) is trivial to execute manually. Historically, similar HMI integrity flaws have been leveraged by advanced persistent threat (APT) groups during pre-attack reconnaissance phases of ICS sabotage campaigns (e.g., the 2015/2016 Ukraine power grid attacks via HMIs), making this a target of interest for state-sponsored actors.