CVE-2026-61886 describes a vulnerability in Weintek cMT3092X firmware where user account passwords are stored in plaintext (CWE-256). This improper storage of sensitive authentication data increases the risk of credential compromise if an attacker gains access to the device or its storage. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. No patch or official remediation level has been published by the vendor as of the data provided.

The vulnerability allows an attacker with network access and low privileges to obtain user passwords in plaintext, leading to a complete compromise of user confidentiality. There is no impact on integrity or availability reported. This could facilitate unauthorized access to the HMI device and potentially further compromise of the industrial control environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected device to trusted users only and monitor for unauthorized access attempts. Avoid exposing the device to untrusted networks. Follow vendor communications for updates on patches or mitigations.