CVE-2024-55021

HighRCE

Published: 03 March 2026

Published

03 March 2026

Modified

09 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0005 15.5th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-55021 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Weintek Easyweb. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 15.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Valid Accounts (T1078) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-9 Previous Logon Notification

addresses: CWE-798

Enables users to notice when hard-coded credentials have been exploited for unauthorized access.

AT-3 Role-based Training

addresses: CWE-798

Security training explicitly warns against hard-coded credentials, lowering their use in systems.

IA-1 Policy and Procedures

addresses: CWE-798

Policy and procedures prohibit hard-coded credentials in favor of managed authentication.

IA-13 Identity Providers and Authorization Servers

addresses: CWE-798

External identity providers eliminate the need for hard-coded credentials in applications.

IA-5 Authenticator Management

addresses: CWE-798

Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.

PL-9 Central Management

addresses: CWE-798

Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.

PM-16 Threat Awareness Program

addresses: CWE-798

Intelligence programs surface reports of campaigns that abuse hard-coded credentials in products, prompting removal or replacement and thereby reducing successful exploitation.

PM-3 Information Security and Privacy Resources

addresses: CWE-798

Planned investment enables secure credential storage and management systems instead of hard-coded credentials.

MITRE ATT&CK Enterprise TechniquesAI

T1078 Valid Accounts Stealth

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

attack.mitre.org →

T1133 External Remote Services Persistence

Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

attack.mitre.org →

Why these techniques?

Hardcoded FTP credentials directly enable remote access to the device using valid accounts over an exposed external service (FTP), granting unauthorized data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol.

Deeper analysisAI

CVE-2024-55021 is a vulnerability in Weintek cMT-3072XH2 devices running easyweb v2.1.53 and OS v20231011, involving a hardcoded password within the FTP protocol. This issue, published on 2026-03-03, is associated with CWE-798 (use of hard-coded credentials) and CWE-78 (improper neutralization of special elements used in an OS command), earning a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

The vulnerability enables remote attackers to exploit it over the network with low attack complexity, requiring no privileges, user interaction, or scope changes. Exploitation grants high confidentiality impact, allowing unauthorized access to sensitive data via the FTP service using the hardcoded password.

Advisories providing further details, including potential mitigation guidance, are available at https://gist.github.com/AenganZ/f86ed0da28825a1432ec697f484622de and https://plain-trick-71d.notion.site/weintek-cMT-3072XH2-14687a89c4c181eeb21ad61e0392f34b?pvs=4.