CVE-2024-55020

The vulnerability results from insufficient input validation (CWE-20) in the DHCP activation function of the easyweb interface. An attacker can submit specially crafted input data containing malicious system commands, which are then passed directly to the operating system command interpreter (CWE-78). Since the vulnerable component runs with root privileges, injected commands are executed with the highest privilege level in the system. The attack is possible remotely over the network without requiring authentication.

An attacker gains full control of the device with root privileges, enabling data reading and modification, installation of malicious software, disruption of HMI device operation, and potential lateral movement in industrial networks (OT/ICS).

Apply patches available from the manufacturer according to the references. Until updates are applied, it is recommended to isolate the device from public networks, restrict access to the easyweb interface exclusively to trusted hosts using a firewall, and monitor network traffic directed to the device.

Weintek cMT-3072XH2 with easyweb Web Version v2.1.53 and OS v20231011