CyberSecBulletin
CVE-2025-14751NVD status: Deferred

cMT3072XH: Unverified Password Change

Published Updated By the CyberSecBulletin desk

CVE-2025-14751 is a high-severity unverified password change vulnerability in cMT3072XH from Weintek, with a CVSS 4.0 base score of 8.7 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists version 20241112 as the first without the flaw, so updating cMT3072XH to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.4% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update cMT3072XH to 20241112 or a later version.
  2. Update cMT3072XH(T) to 20241112 or a later version.
  3. Update cMT-SVRX-820 to 20240919 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
WeintekcMT3072XH20200630 up to, but not including, 2024111220241112
WeintekcMT3072XH(T)20200630 up to, but not including, 2024111220241112
WeintekcMT-SVRX-82020220413 up to, but not including, 2024091920240919
WeintekcMT-CTRL0120230308 up to, but not including, 2025082720250827

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Attack requirements
NoneThe attack does not depend on a particular deployment or configuration.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Confidentiality (vulnerable system)
HighSerious loss of confidentiality on the vulnerable system.
Integrity (vulnerable system)
HighSerious loss of integrity on the vulnerable system.
Availability (vulnerable system)
HighSerious loss of availability on the vulnerable system.
Confidentiality (other systems)
NoneNo loss of confidentiality on systems beyond the vulnerable one.
Integrity (other systems)
NoneNo loss of integrity on systems beyond the vulnerable one.
Availability (other systems)
NoneNo loss of availability on systems beyond the vulnerable one.

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (hq.dhs.gov).

Official description

A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Unverified Password Change

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

How developers prevent this class of flaw

  • When prompting for a password change, force the user to provide the original password in addition to the new password.
  • Do not use forgotten password functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.

More Unverified Password Change vulnerabilities (CWE-620)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in cMT3072XH

All cMT3072XH vulnerabilities

Recent Unverified Password Change vulnerabilities

Spotted an error? Tell us.