The Weintek cMT3092X firmware contains a vulnerability (CVE-2026-61892) where a non-privileged user can manipulate authentication tokens to gain elevated privileges. This is a CWE-732 type issue, indicating improper permission assignment that enables privilege escalation. The vulnerability has a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No remediation level or patch information is currently available, and no exploits have been reported in the wild.

Successful exploitation allows an attacker with limited privileges to escalate their access rights, potentially leading to full control over the affected HMI device. This can compromise confidentiality, integrity, and availability of the system, impacting operational technology environments that rely on the Weintek cMT3092X firmware.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device to trusted users only and monitor for suspicious activity related to token manipulation. Avoid exposing the device directly to untrusted networks.