彙總 weintek 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 緩衝區溢位與記憶體損壞 等問題，部分漏洞可能導致 檔案覆寫，並影響 軟體部署與生產負載 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2024-55027 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db. | [email protected] | 7.5 | 0.21% | 2026-03-03 | 2026-06-17 |
| CVE-2024-55026 | An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request. | [email protected] | 9.8 | 0.34% | 2026-03-03 | 2026-06-17 |
| CVE-2024-55025 | Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system. | [email protected] | 6.5 | 0.30% | 2026-03-03 | 2026-06-17 |
| CVE-2024-55024 | An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to perform Administrative actions using service accounts. | [email protected] | 9.8 | 0.36% | 2026-03-03 | 2026-06-17 |
| CVE-2024-55023 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive information. | [email protected] | 5.3 | 0.17% | 2026-03-03 | 2026-06-17 |
| CVE-2024-55022 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter. | [email protected] | 8.8 | 1.29% | 2026-03-03 | 2026-06-17 |
| CVE-2024-55021 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. | [email protected] | 7.5 | 0.34% | 2026-03-03 | 2026-06-17 |
| CVE-2024-55020 | A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges. | [email protected] | 9.8 | 1.67% | 2026-03-03 | 2026-06-17 |
| CVE-2024-55019 | Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to download arbitrary files. | [email protected] | 7.5 | 0.29% | 2026-03-03 | 2026-06-17 |
| CVE-2023-50466 | An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter. | [email protected] | 8.8 | 1.90% | 2023-12-19 | 2026-06-17 |
| CVE-2023-5777 | Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server. | [email protected] | 9.8 | 0.54% | 2023-11-06 | 2026-06-17 |
| CVE-2023-43492 | In Weintek's cMT3000 HMI Web CGI device, the cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication. | [email protected] | 9.8 | 0.88% | 2023-10-19 | 2026-06-17 |
| CVE-2023-40145 | In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device. | [email protected] | 8.8 | 1.17% | 2023-10-19 | 2026-06-17 |
| CVE-2023-38584 | In Weintek's cMT3000 HMI Web CGI device, the cgi-bin command_wb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication. | [email protected] | 9.8 | 1.05% | 2023-10-19 | 2026-06-17 |
| CVE-2023-37362 | Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website. | [email protected] | 7.2 | 0.51% | 2023-07-19 | 2026-06-17 |
| CVE-2023-35134 | Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only. | [email protected] | 7.4 | 0.38% | 2023-07-19 | 2026-06-17 |
| CVE-2023-34429 | Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token. | [email protected] | 7.5 | 0.53% | 2023-07-19 | 2026-06-17 |
| CVE-2023-32657 | Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses. | [email protected] | 5.3 | 0.43% | 2023-07-19 | 2026-06-17 |
| CVE-2023-0104 | The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data. | [email protected] | 9.3 | 21.85% | 2023-02-22 | 2026-06-17 |
| CVE-2021-27446 | The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system. | [email protected] | 10.0 | 2.78% | 2022-05-16 | 2026-06-16 |