Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2024-55021 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Weintek Easyweb. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-55021 is a vulnerability in Weintek cMT-3072XH2 devices running easyweb v2.1.53 and OS v20231011, involving a hardcoded password within the FTP protocol. This issue, published on 2026-03-03, is associated with CWE-798 (use of hard-coded credentials) and CWE-78 (improper neutralization of special elements used in an OS command), earning a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
The vulnerability enables remote attackers to exploit it over the network with low attack complexity, requiring no privileges, user interaction, or scope changes. Exploitation grants high confidentiality impact, allowing unauthorized access to sensitive data via the FTP service using the hardcoded password.
Advisories providing further details, including potential mitigation guidance, are available at https://gist.github.com/AenganZ/f86ed0da28825a1432ec697f484622de and https://plain-trick-71d.notion.site/weintek-cMT-3072XH2-14687a89c4c181eeb21ad61e0392f34b?pvs=4.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-55460
Vulnerability Data
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5V1.2.8V15.2.5
Mitigating Controls (NIST 800-53 r5) AI
Authenticator management requires secure distribution and handling of credentials, structurally discouraging hard-coded values.
Developer testing and evaluation can discover missing or incorrect command sanitization during development.
Cryptographic key management mandates proper establishment and handling instead of embedding keys in code.
Input validation directly neutralizes or rejects special characters that would otherwise alter OS command structure.
Least privilege reduces the permissions available to any process that could be subverted by injected commands.
Least functionality restricts available OS commands and interpreters, limiting the blast radius of injection.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.
PR.AA-01's credential/key-management processes can reduce the incentive to embed secrets but do not address or detect hard-coded values in source code, so the weakness remains fully possible.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
PR.AA-02 addresses human identity proofing and per-person credential issuance at enrollment; it has no bearing on whether developers embed static credentials in software.
PR.DS-01 addresses encryption and integrity of stored data but never touches credential or key management practices, so it neither prevents hard-coded credentials nor removes any of their risk.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.
Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.
Secure key-generation, distribution and storage procedures reduce the likelihood that hard-coded or default cryptographic keys will be introduced or left unprotected.
Explicit prohibition of hard-coded passwords and unauthenticated external services stops credentials from being embedded directly in source code.
Contractual requirements for secure coding practices and evidence of testing make it less likely that hard-coded credentials will be introduced or remain undetected in delivered code.
Requiring independent oversight and timely disabling of non-human identities makes it harder for hard-coded or long-lived credentials to remain exploitable.