CVE-2024-55027

Executive Summary

CVE-2024-55027 exposes a critical security flaw in the Weintek cMT-3072XH2 HMI (Human-Machine Interface) device running easyweb v2.1.53 and OS v20231011. The vulnerability allows an attacker with local or remote access to the device’s filesystem to retrieve stored credentials in plaintext from the uac_temp.db database file. This constitutes a Cleartext Storage of Sensitive Information (CWE-312), enabling privilege escalation, lateral movement, and potential compromise of industrial control systems (ICS). The vendor has not released a patch, and no official advisory or OSV data exists. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk to targeted ICS environments is severe.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary embedded system (Weintek HMI) and its firmware. The supply chain risk lies in the device’s firmware distribution and the lack of secure credential storage mechanisms.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – The device is network-accessible via easyweb.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires access to the filesystem (e.g., via web interface or local shell).
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the HMI itself.
• Confidentiality (C): High (H) – Credentials are exposed.
• Integrity (I): None (N) – No direct integrity impact.
• Availability (A): None (N) – No direct availability impact.

Estimated CVSS Score: 6.5 (Medium) – However, in an ICS context, the impact is higher due to potential for lateral movement to critical controllers.

Threat Level: High for targeted attacks against industrial environments.

Deep Dive & Mechanics

The vulnerability resides in the uac_temp.db file, which is a SQLite database used by the Weintek HMI’s easyweb interface to store user account credentials. The database is not encrypted or hashed; credentials are stored in plaintext. An attacker who gains access to the device’s filesystem (e.g., via a web shell, default credentials, or another vulnerability) can simply read this file and extract all usernames and passwords.

Root Cause: The application uses a temporary database (uac_temp.db) for user account management without applying any cryptographic protection. This is a classic violation of CWE-312 (Cleartext Storage of Sensitive Information).

Attack Vector: The attacker must first obtain access to the device’s filesystem. This could be achieved through:

• Default or weak credentials for the web interface.
• Exploitation of another vulnerability (e.g., command injection, path traversal).
• Physical access to the device.

Once access is gained, the attacker can navigate to the database file (typically located in the application’s data directory) and exfiltrate it.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The application likely uses a SQLite database to store user credentials without encryption. For example:

import sqlite3
conn = sqlite3.connect('uac_temp.db')
conn.execute('CREATE TABLE users (username TEXT, password TEXT)')
conn.execute('INSERT INTO users VALUES ("admin", "password123")')
conn.commit()

Patched Code (Hypothetical): A secure implementation would hash passwords using a strong algorithm (e.g., bcrypt) and store only the hash:

import sqlite3
import bcrypt
conn = sqlite3.connect('uac.db')
hashed = bcrypt.hashpw(b'password123', bcrypt.gensalt())
conn.execute('CREATE TABLE users (username TEXT, password_hash TEXT)')
conn.execute('INSERT INTO users VALUES ("admin", ?)', (hashed,))
conn.commit()

Since no patch is available, the vulnerable code remains in production.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Weintek cMT-3072XH2 with easyweb v2.1.53 and OS v20231011.
• Attacker machine with Kali Linux and SQLite browser.

Exploitation Steps:

1. Gain Access: Use default credentials (e.g., admin/admin) or exploit another vulnerability to obtain a shell or web access.
2. Locate Database: Navigate to the application directory (e.g., /usr/local/easyweb/data/ or similar).
3. Exfiltrate Database: Download uac_temp.db via HTTP, FTP, or SCP.
4. Extract Credentials: Open the database with a SQLite client:

   sqlite3 uac_temp.db
   .tables
   SELECT * FROM users;
   

5. Use Credentials: Leverage extracted credentials for lateral movement to other HMIs, PLCs, or SCADA systems.

Example SQLite commands:

-- List tables
.tables
-- Dump all data
SELECT * FROM users;

Blue Team (Defensive)

Detection & Response:

• Monitor for unauthorized access to the device’s web interface.
• Alert on unusual file downloads (e.g., uac_temp.db).
• Implement network segmentation to limit HMI exposure.
• Use file integrity monitoring (FIM) to detect changes to uac_temp.db.

Hunting Queries:

• Search logs for SELECT * FROM users or sqlite3 commands.
• Look for outbound connections from the HMI to unknown IPs.

Indicators of Compromise (IOCs)

• File: uac_temp.db (SQLite database containing plaintext credentials)
• Network: Unusual outbound connections from the HMI (e.g., to attacker C2)
• Process: sqlite3 or sqlitebrowser running on the HMI (if attacker gains shell)
• Logs: Failed login attempts followed by successful login from unusual IPs
• Registry/Config: Modified user accounts in the HMI’s web interface

Detection Engineering

YARA Rule

rule CVE_2024_55027_Weintek_Credentials
{
    meta:
        description = "Detects uac_temp.db file containing plaintext credentials"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55027"
    strings:
        $db_header = "SQLite format 3"
        $table_users = "CREATE TABLE users"
        $password_col = "password TEXT"
    condition:
        $db_header at 0 and $table_users and $password_col
}

Sigma Rule

title: Detection of uac_temp.db Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to the uac_temp.db file on Weintek HMI
logsource:
    category: file_access
    product: linux
detection:
    selection:
        TargetFilename|endswith: 'uac_temp.db'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55027 Weintek uac_temp.db Exfiltration"; flow:to_server,established; content:"uac_temp.db"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the HMI: Place the device on a separate VLAN with strict firewall rules.
2. Change Default Credentials: Immediately change all default passwords.
3. Monitor Access: Enable logging and monitor for unauthorized access attempts.
4. Disable Unused Services: Turn off easyweb if not required.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Weintek that encrypts credentials.
• Workaround: If possible, replace the uac_temp.db with a read-only file containing hashed credentials (requires custom firmware modification).
• Network Segmentation: Implement strict network segmentation between HMIs and other ICS components.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact: intelligence@valters-it.com