The Weintek cMT3092X HMI firmware contains a vulnerability (CVE-2026-60134) where a non-privileged user can manipulate cookies to escalate privileges improperly. This vulnerability is classified as CWE-784, indicating that the application does not correctly control access to resources via cookie modification. The CVSS 3.1 score of 8.8 reflects network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and no known exploits have been reported.

Successful exploitation allows an attacker with limited privileges to gain elevated privileges on the affected device, potentially leading to full control over the HMI system. This can compromise confidentiality, integrity, and availability of the system, impacting operational technology environments relying on the cMT3092X firmware.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device to trusted users only and monitor for unauthorized access attempts. Avoid exposing the device to untrusted networks to reduce risk.