CVE-2024-55026

critical · 9.8

An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request.

9.8

CVSS

0.3%

EPSS (exploit prob.)

28th

EPSS percentile

2026-03-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-256

Affected products

Vendor	Product	Affected versions
weintek	easyweb	2.1.53
weintek	cmt-3072xh2_firmware	20231011
weintek	cmt-3072xh2	all versions

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/AenganZ/f86ed0da28825a1432ec697f484622de
https://plain-trick-71d.notion.site/weintek-cMT-3072XH2-14687a89c4c181eeb21ad61e0392f34b?pvs=4

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-55026