CVE-2026-60135: Authentication Bypass Vulnerability

CVE-2026-60135 Overview

CVE-2026-60135 is an improper access control vulnerability [CWE-286] affecting Weintek cMT EasyWeb V2. An authenticated attacker with low privileges can modify data that should be restricted to read-only access over the network. The flaw allows unauthorized write operations against protected resources, breaking the integrity boundary enforced by the application. CISA published an ICS advisory tracking this issue, indicating exposure in operational technology environments.

Critical Impact
Authenticated attackers can bypass read-only restrictions to alter protected data, undermining the integrity of industrial control system configurations and operational data.

Affected Products

Weintek cMT EasyWeb V2
Weintek cMT series HMI devices exposing EasyWeb V2
See the Weintek Security Issues Document for the vendor-published affected product list

Discovery Timeline

2026-07-24 - CVE-2026-60135 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-60135

Vulnerability Analysis

The vulnerability resides in the authorization logic of Weintek cMT EasyWeb V2, the web interface for cMT-series human-machine interface (HMI) devices. The system exposes data objects intended to be read-only to authenticated users, but the enforcement layer does not correctly validate write requests against the assigned permission set. An attacker holding low-privilege credentials can therefore submit modification requests that the server accepts and applies.

Because the affected component runs on ICS-adjacent devices, tampering with read-only values can influence downstream operational logic. The impact scope is limited to integrity: no confidentiality loss or availability degradation is reported in the CVSS vector, and the attack requires prior authentication.

Root Cause

The root cause is incorrect authorization ([CWE-286]) where the application relies on the client-declared access mode rather than server-side enforcement of read-only constraints. Permissions granted for viewing data are treated as sufficient for writing, resulting in a broken access control boundary.

Attack Vector

Exploitation occurs over the network against the EasyWeb V2 interface. The attacker authenticates with valid low-privilege credentials, then issues a crafted write request targeting an object exposed as read-only in the interface. The server processes the modification without re-validating the object's access mode, persisting the attacker-controlled value. No user interaction is required.

No verified public proof-of-concept code is available. Refer to the CISA ICS Advisory ICSA-26-204-03 and the GitHub CSAF file for technical details.

Detection Methods for CVE-2026-60135

Indicators of Compromise

Unexpected modifications to configuration values or tags that were previously flagged as read-only in cMT EasyWeb V2
Authenticated HTTP requests from low-privilege user accounts targeting write endpoints on the EasyWeb V2 web interface
Session activity from user accounts performing write operations outside their normal role scope

Detection Strategies

Enable and centralize access logs from cMT EasyWeb V2 to correlate authentication events with subsequent write operations
Baseline expected write activity per user role and alert on deviations, especially write requests against objects designated read-only
Monitor network traffic to HMI management interfaces for unusual POST or PUT operations originating from non-engineering workstations

Monitoring Recommendations

Ingest HMI and OT device logs into a centralized SIEM for continuous correlation with identity and network telemetry
Track configuration state of Weintek HMI devices and alert on drift between known-good baselines and current values
Review authentication logs for the EasyWeb V2 interface and investigate any low-privilege accounts performing administrative-style actions

How to Mitigate CVE-2026-60135

Immediate Actions Required

Apply the firmware update referenced in the Weintek Security Issues Document to affected cMT devices
Restrict network access to the EasyWeb V2 interface to trusted engineering workstations using firewall or VLAN segmentation
Rotate credentials for all EasyWeb V2 user accounts and enforce least-privilege role assignments
Review recent write activity on affected devices to identify potential unauthorized modifications

Patch Information

Weintek has published guidance in the cMT EasyWeb V2 Security Issues Document. Administrators should follow the vendor advisory and the CISA ICS Advisory ICSA-26-204-03 for the current fixed firmware versions and upgrade procedures.

Workarounds

Isolate cMT HMI devices behind an ICS-DMZ and block direct exposure to corporate or internet-facing networks
Disable or restrict low-privilege user accounts on EasyWeb V2 until the firmware update is applied
Deploy network monitoring on the OT segment to detect anomalous write requests to HMI endpoints
Enforce multi-factor authentication on jump hosts used to reach the EasyWeb V2 management interface where technically feasible