CVE-2024-55024 is a critical (9.8) authentication bypass in the easyweb interface of the Weintek cMT-3072XH2 HMI, easyweb v2.1.53 with OS v20231011. The record says unauthorized attackers can perform administrative actions using service accounts. No fix is named, so isolate the device and ask Weintek about an update.
What's affected
The record lists the Weintek cMT-3072XH2 (hardware and firmware) and easyweb, with easyweb v2.1.53 and OS v20231011 named as the tested version. The weakness is recorded as CWE-693, protection mechanism failure.
The CVSS vector is AV:N/AC:L/PR:N/UI:N, rated high for confidentiality, integrity and availability. The record does not name a fixed version. Its references are a public write up and a notes page, which I did not fetch, so I describe only what the record says.
How to check if you're exposed
Check the device and its exposure.
- Read the easyweb and OS versions from the device settings or from the vendor tools used to manage it.
- Check whether the device web interface is reachable from anything other than the engineering network. A scan of your own address space for open management ports will show internet exposure.
- Review the device account list for service accounts you do not recognize.
- Review project and configuration files on the device for unexpected changes.
What to do now
- Take the HMI off any internet facing or flat network. Put it in an isolated industrial network zone behind a firewall.
- Contact Weintek for a firmware update that addresses this CVE, and apply it in a maintenance window. The record does not name one.
- Disable the web interface if you do not need it.
- Change all device credentials after isolating it.
- Review plant network segmentation, since HMIs are trusted by the controllers they talk to.
Why it matters
The record classes the flaw as CWE-693, protection mechanism failure. The authorization check that should separate administrators from everyone else can be skipped, in the record's words by using service accounts.
HMIs sit between operators and machines. Administrative control of one can change what operators see and what is sent to controllers. Industrial gear is hard to patch, which makes network isolation the main control until a firmware update is available.
Quick check
Is a fix available?
The record does not name one. Contact Weintek and isolate the device in the meantime.
Sources
Last reviewed: 19 October 2026.
