October 17, 2023 at 09:30AM
Weintek’s cMT HMI product has been found to have critical vulnerabilities that could be exploited by attackers. The vulnerabilities allow anonymous users to bypass authentication and execute arbitrary commands. If all vulnerabilities are combined, an attacker could gain full control of the HMI system. Weintek has released patches for affected products.
Key Takeaways:
1. The US cybersecurity agency CISA has issued a warning about critical and high-severity vulnerabilities found in the Weintek cMT HMI (human-machine interface) product made by Weintek, a Taiwan-based company.
2. These vulnerabilities can be exploited by anonymous users to bypass authentication or execute arbitrary commands after logging into the targeted device.
3. Weintek has released patches for the affected cMT3000-series, cMT-HDM, and cMT-FHD products.
4. Researchers from industrial cybersecurity firm TXOne Networks discovered the vulnerabilities and published technical details about each of them in a blog post.
5. Although an attacker does not require special permissions to launch a Denial of Service (DoS) attack, executing arbitrary commands requires the HMI’s password.
6. While some Weintek HMIs are directly exposed to the internet, these instances are limited.
7. Earlier this year, CISA informed organizations about vulnerabilities found by TXOne in Weintek’s Weincloud cloud-based HMI, which could allow attackers to manipulate and damage industrial control systems (ICS).