CVE-2024-3740 is a medium severity vulnerability (CVSS 6.3) in cym1102 nginxWebUI. The function exec behind /adminPage/conf/reload handles the nginxExe argument through unsafe deserialization. The record names no fixed version. Below you will find the affected versions, how to check your exposure, and a short list of steps to take now.
What's affected
- cym1102 nginxWebUI up to and including 3.9.9, according to the record.
Severity in the record: Medium, CVSS 6.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms: over the network, low privileges required, no user interaction. Weakness class: CWE-502, deserialization of untrusted data.
Fixed version: The record names no fixed version. The project's GitHub issue 138 is listed in the references, so check it and the project releases for a newer build than 3.9.9.
Source conflict: The disclosure text in the record calls this issue critical, while the CVSS base score of 6.3 rates it Medium. This post follows the score, and both views are stated here so you can judge it against your own exposure.
The record says the exploit has been disclosed to the public and may be used. That is a statement from the disclosure, not a CISA Known Exploited Vulnerabilities listing, and the record's KEV flag is false.
How to check if you're exposed
- Find the version of the jar you run:
ls *.jarin the install directory, or check the container image tag if you deploy it in Docker. - Check whether the panel's port is reachable from outside: scan your own host from an outside network.
What to do now
- Apply a fixed release when one is available.
- Keep the management interface off the public internet.
- Log and review requests to the affected endpoint.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3740.
Why it matters
Deserialization turns stored or transmitted bytes back into live objects. If the input is attacker controlled and the format can describe arbitrary object types, the process can be pushed into behavior the developer did not intend. The usual defenses are to avoid native object serialization for external data, use plain data formats, and allow only known types.
The same research write-up covers several flaws in this panel, so fixing one finding without reviewing the rest leaves the host exposed. The record says the exploit has been disclosed to the public. The project is a small open source panel, and this post found no confirmed maintainer fix.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
Is nginxWebUI the same as nginx?
No. nginxWebUI is a separate web panel for managing nginx configuration. The CVE affects the panel, not nginx itself.
Is CVE-2024-3740 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
