Weintek EasyBuilder Pro cMT Series

An attacker could gain control of an engineering workstation running EasyBuilder Pro by sending a malicious project file, potentially allowing them to modify HMI configurations, steal credentials, or compromise PLC program uploads. This could result in unauthorized changes to process setpoints, shutdown of critical systems, or exfiltration of operational data.

Engineering teams at water utilities, electric generation/distribution, and other critical infrastructure facilities that use Weintek EasyBuilder Pro to develop or maintain HMI (Human-Machine Interface) configurations. This affects anyone who creates, modifies, or troubleshoots graphical control interfaces for PLCs and industrial control systems.

An attacker creates a malicious EasyBuilder Pro project file exploiting the path traversal vulnerability and sends it to an engineer. When the engineer decompiles the file to view or modify it, the vulnerability allows the attacker's code to execute on the engineering workstation with the user's privileges, gaining machine control.