CVE-2024-1039 is a Critical flaw, scored 9.8, in Gessler GmbH WEB-MASTER. A restoration account uses weak, hard coded credentials that could give an attacker control of the device's web management. CISA's advisory recommends updating WEB-MASTER to 4.4 or later and EZ2 to 3.2 or later.
What's affected
The record lists WEB-MASTER firmware 7.9 and the WEB-MASTER hardware as affected. The CISA advisory ICSA-24-032-01 also names the vendor's fixed versions: WEB-MASTER 4.4 or later, and EZ2 3.2 or later.
The version numbers look odd next to each other, since 7.9 is higher than 4.4. Both come from the sources as written, and they probably use different numbering for firmware and the management software. Confirm with Gessler which of your units map to which version before you act.
How to check if you're exposed
The sources give no command or scan. Start with an inventory of building or industrial automation devices from Gessler and note the model and firmware version shown in the device's web management page or in your asset records.
Then check network reachability. Can the web management interface of any unit be reached from the internet or from a business network that should not have access? CISA's guidance for control system devices is to keep them off the internet and behind firewalls, separated from business networks.
What to do now
- List every WEB-MASTER unit and its firmware version.
- Contact Gessler GmbH. CISA states that only Gessler technicians can apply the updates, so book the work rather than looking for a download.
- Until the update is done, remove any path from the internet to the device, and put remote access behind a VPN that you keep current.
- Run an impact analysis and risk assessment before deploying defensive measures, as CISA advises, so you do not disrupt the building systems the device runs.
- Record the change and re-check the unit after the vendor visit.
Why it matters
The cause is use of hard coded credentials, CWE-798, together with improper authentication, CWE-287. A built in account with a fixed, guessable secret cannot be rotated by the owner, so anyone who learns it can reach the management interface. The record's CVSS vector shows a network attack with no privileges and no user interaction, which is why the score is 9.8.
CISA says it has no reports of known public exploitation targeting this vulnerability, and the record's KEV flag is false. That is a statement about reports so far, not a guarantee. A device with fixed credentials reachable from the internet is worth fixing on that basis alone.
Quick check
Can I patch this myself?
According to the CISA advisory, only Gessler GmbH technicians can apply the updates. Use the vendor contact route listed in the advisory.
Is it exploited in the wild?
CISA reports no known public exploitation, and the CISA KEV flag in the record is false.
Sources
Last reviewed: 19 October 2026.
