CVE-2024-55019
📋 TL;DR
This vulnerability allows unauthenticated attackers to download arbitrary files from Weintek cMT-3072XH2 HMI devices via the download_wb.cgi component. It affects devices running easyweb Web Version v2.1.53 with OS v20231011. Attackers can access sensitive files without authentication.
💻 Affected Systems
- Weintek cMT-3072XH2
📦 What is this software?
Easyweb by Weintek
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise through extraction of configuration files, credentials, or sensitive operational data leading to industrial process disruption or lateral movement into OT networks.
Likely Case
Exfiltration of configuration files containing network settings, device credentials, or PLC programming logic that could enable further attacks.
If Mitigated
Limited impact if device is isolated behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
Simple HTTP request to download_wb.cgi with file parameter allows arbitrary file download. Public proof-of-concept available in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Monitor Weintek website for security updates. Consider upgrading to newer versions if available.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to the device web interface using firewall rules
Disable Web Interface
allDisable the easyweb web interface if not required for operations
🧯 If You Can't Patch
- Implement strict network segmentation to isolate HMI devices from untrusted networks
- Deploy web application firewall (WAF) rules to block requests to download_wb.cgi
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[device_ip]/download_wb.cgi?file=/etc/passwd (or other known files) without authenticationCheck Version:
Check device web interface or configuration for version informationVerify Fix Applied:
Verify that unauthenticated requests to download_wb.cgi return access denied or 404 errors📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful download_wb.cgi access
- Unusual file download patterns from HMI web interface
Network Indicators:
- HTTP GET requests to /download_wb.cgi with file parameter from untrusted sources
- Unusual outbound data transfers from HMI devices
SIEM Query:
source_ip=[HMI_IP] AND (url_path CONTAINS 'download_wb.cgi' OR http_method='GET' AND url_query CONTAINS 'file=')