Weintek cMT-3072XH2 Hardcoded Encryption Key Vulnerability in easyweb

A vulnerability exists in the Weintek cMT-3072XH2 HMI device running easyweb version 2.1.53 and OS version 20231011, due to a hardcoded encryption key. This key can potentially allow attackers to decrypt intercepted JSON communications and access sensitive system information. Additionally, the device stores user credentials in plaintext within local database files, further exposing sensitive data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to decrypted communications, allowing interception of sensitive information. The plaintext storage of user credentials in database files also poses a significant security risk, as it exposes authentication data without any protection.