CVE-2024-55026

The attacker sends a specially crafted HTTP GET request to the reset_pj.cgi endpoint available in the device's easyweb interface. The endpoint does not verify the requester's identity or filter input data, leading to the execution of system commands embedded in the request in the device's context. The vulnerability is classified as CWE-256, indicating unsafe storage or handling of authentication data.

An unauthenticated remote attacker can execute arbitrary commands on the device, leading to a complete breach of confidentiality, integrity and availability of the system, including potential takeover of the HMI panel in an industrial environment.

Patches available from the manufacturer should be applied according to the references. Until the fix is deployed, it is recommended to restrict network access to the easyweb interface through a firewall, implement OT/ICS network segmentation, and disable unused network interfaces on the device.

Weintek cMT-3072XH2 with easyweb v2.1.53 software and OS v20231011 operating system