Critical Vulnerabilities Expose ​​Weintek HMIs to Attacks

The US cybersecurity agency CISA last week warned organizations about critical- and high-severity vulnerabilities discovered by researchers in a human-machine interface (HMI) product made by Taiwan-based Weintek.

According to CISA, the impacted product, the Weintek cMT HMI, is used worldwide, including in critical manufacturing organizations, which are considered part of critical infrastructure. The vendor has released patches for cMT3000-series, cMT-HDM, and cMT-FHD products.

A total of three vulnerabilities have been found in the HMI by industrial cybersecurity firm TXOne Networks. They can be exploited by anonymous users to bypass the authentication process or execute arbitrary commands after they log in to the targeted device.

“By combining [the vulnerabilities], a remote attacker may gain access to the system or remotely execute commands without authentication via the web server whose OS version is listed as affected,” Weintek said in its own advisory last week. 

Hank Chen, the TXOne Networks researcher credited for finding the vulnerabilities, told SecurityWeek that the flaws could allow an attacker to take complete control of an HMI. 

However, Chen noted that while an attacker does not require any special permissions to launch a DoS attack, executing arbitrary commands requires the HMI’s password. 

The researcher said there are some impacted Weintek HMIs that are directly exposed to the internet, but such instances are “quite limited”.

TXOne has published a blog post providing technical details for each of the vulnerabilities. 

This is not the first time TXOne researchers have found vulnerabilities in Weintek products. Earlier this year, CISA informed organizations about several issues identified by TXOne in the Weincloud cloud-based HMI, which could allow an attacker to manipulate and damage industrial control systems (ICS), such as PLCs and field devices.