CVE-2026-61886 identifies a vulnerability in the Weintek cMT3092X firmware where user account passwords are stored in plaintext. This improper storage of sensitive information (CWE-256) increases the risk of credential compromise if the device is accessed by unauthorized parties. The vulnerability has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector with low complexity and low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. No patch or official remediation level has been provided by the vendor as of the published date.

The plaintext storage of passwords allows an attacker with network access and low privileges to potentially obtain user credentials, leading to a complete compromise of confidentiality for user accounts on the affected device. There is no impact on integrity or availability reported. This vulnerability could facilitate unauthorized access to the HMI device and its functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device to trusted users only and monitor for unauthorized access attempts. Avoid exposing the device directly to untrusted networks.