CVE-2024-55020

critical · 9.8

A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges.

9.8

CVSS

1.7%

EPSS (exploit prob.)

76th

EPSS percentile

2026-03-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20CWE-78

Affected products

Vendor	Product	Affected versions
weintek	easyweb	2.1.53
weintek	cmt-3072xh2_firmware	20231011
weintek	cmt-3072xh2	all versions

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/AenganZ/f86ed0da28825a1432ec697f484622de
https://plain-trick-71d.notion.site/weintek-cMT-3072XH2-14687a89c4c181eeb21ad61e0392f34b?pvs=4

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-55020