CVE-2024-55026 is a critical (9.8) command injection in the reset_pj.cgi endpoint of the Weintek cMT-3072XH2 HMI, easyweb v2.1.53 with OS v20231011. A crafted GET request runs commands without authentication. No fix is named in the record, so isolate the device and contact Weintek.
What's affected
The record lists the Weintek cMT-3072XH2 hardware and firmware and easyweb, with easyweb v2.1.53 and OS v20231011 as the tested release. The vulnerable endpoint is reset_pj.cgi and the trigger is a crafted GET request.
The CVSS vector is AV:N/AC:L/PR:N/UI:N, rated high across confidentiality, integrity and availability. The record does not name a fixed version.
The record assigns CWE-256, plaintext storage of a password. That does not obviously match the command execution that the description gives, so treat the description as your guide to the risk and the CWE as a label that may be imprecise.
How to check if you're exposed
Check the device and exposure.
- Read the easyweb and OS versions on the device or in the management tool.
- Find out which networks can reach the device web interface. Treat reachability from the internet or from office networks as exposure.
- Search firewall and proxy logs for requests to a reset_pj.cgi path.
- Check the device for unexpected processes, files or configuration changes if the tooling lets you.
What to do now
- Block access to the web interface from every network except a small engineering segment.
- Ask Weintek for a firmware update and apply it when it exists. The record does not list one.
- Disable the web service if the device can operate without it.
- Change device credentials after isolating it, because a command execution flaw can expose them.
- Add this device to your asset inventory with its firmware, so future advisories can be matched.
Why it matters
The description matches CWE-78, OS command injection, where request data ends up in a command run by the device. The record lists CWE-256 instead, so the label and the narrative differ. Always read the description when you triage.
Command execution on an HMI gives control of a device that is trusted by the controllers around it. Because firmware updates for industrial devices are slow to arrive, reduce exposure first and update second.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does the CWE not match?
The record lists CWE-256, but the description reads like command injection. Use the description to judge the risk.
Sources
Last reviewed: 19 October 2026.
