CVE-2025-14750 - Vulnerability Details - OpenCVE

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-05

History

Thu, 22 Jan 2026 23:00:00 +0000

Type	Values Removed	Values Added
Description		The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges.
Title		External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service
Weaknesses		CWE-472
References		https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-05
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2026-01-22T21:40:56.977Z

Updated: 2026-01-22T21:40:56.977Z

Reserved: 2025-12-15T20:40:03.048Z

Link: CVE-2025-14750

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-01-22T22:16:14.803

Modified: 2026-01-22T22:16:14.803

Link: CVE-2025-14750

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14750", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-12-15T20:40:03.048Z", "datePublished": "2026-01-22T21:40:56.977Z", "dateUpdated": "2026-01-22T21:40:56.977Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "cMT3072XH", "vendor": "Weintek", "versions": [{"lessThan": "20241112", "status": "affected", "version": "20200630", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "cMT3072XH(T)", "vendor": "Weintek", "versions": [{"lessThan": "20241112", "status": "affected", "version": "20200630", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "cMT-SVRX-820", "vendor": "Weintek", "versions": [{"lessThan": "20240919", "status": "affected", "version": "20220413", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "cMT-CTRL01", "vendor": "Weintek", "versions": [{"lessThan": "20250827", "status": "affected", "version": "20230308", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Joel Aviad Ossi of WebSec B.V reported these vulnerabilities to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges. <br><br>"}], "value": "The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can modify the parameters and potentially manipulate account-level privileges."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-472", "description": "CWE-472 External Control of Assumed-Immutable Web Parameter", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-01-22T21:40:56.977Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-05"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Weintek recommends users implement the following mitigation techniques: <br><br>* cMT3072XH: Version 20241112<br>* cMT3072XH(T): Version 20241112<br>* cMT-SVRX-820: Version 20240919<br>* cMT-CTRL01: Version 20250827<br><br>For more information, see Weintek's planned notice: <a target=\"_blank\" rel=\"nofollow\" href=\"https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf\">https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf</a><br>"}], "value": "Weintek recommends users implement the following mitigation techniques: \n\n* cMT3072XH: Version 20241112\n* cMT3072XH(T): Version 20241112\n* cMT-SVRX-820: Version 20240919\n* cMT-CTRL01: Version 20250827\n\nFor more information, see Weintek's planned notice: https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf"}], "source": {"discovery": "UNKNOWN"}, "title": "External Control of Assumed-Immutable Web Parameter in Weintek cMT X Series HMI EasyWeb Service", "x_generator": {"engine": "Vulnogram 0.5.0"}}}}