CVE-2024-55020:

Command injection vulnerability in Weintek cMT-3072XH2 easyweb allows root-level arbitrary command execution.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Mar 3, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Command injection vulnerability in Weintek cMT-3072XH2 easyweb allows root-level arbitrary command execution.

Overview

The vulnerability affects the DHCP activation feature in Weintek cMT-3072XH2 easyweb, specifically Web Version v2.1.53 and OS v20231011. It is classified as a command injection vulnerability, which is a type of security flaw that allows attackers to execute arbitrary system commands through a vulnerable application. In this case, the commands can be executed with root privileges, granting the attacker the highest level of access to the system. The vulnerability has been assigned a CVSS v3.1 base score of 9.8, categorizing it as Critical severity. This high score is due to the vulnerability being exploitable over the network without requiring any privileges or user interaction, and potentially resulting in a complete compromise of the system's confidentiality, integrity, and availability.

Remediation

As of the current information available, no specific remediation steps have been provided by the vendor. However, general best practices for mitigating command injection vulnerabilities include:
1. Updating the affected software to the latest version once a patch is available.
2. Implementing strong input validation and sanitization mechanisms.
3. Applying the principle of least privilege to limit the potential impact of successful exploits.
4. Monitoring systems for unusual activities or unauthorized access attempts.
5. Restricting network access to the affected systems where possible.
Users and administrators of Weintek cMT-3072XH2 easyweb systems should monitor the vendor's official channels for security advisories and apply any recommended patches or updates as soon as they become available.