Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

cMT-3072XH2-easyweb

An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request.

CVE-2024-55026 is a command injection vulnerability found in the reset_pj.cgi endpoint of the Weintek cMT-3072XH2 easyweb interface version 2.1.53 running OS version 20231011. This endpoint improperly validates or restricts input parameters in GET requests, allowing an attacker with limited privileges (PR:L) to execute arbitrary system commands remotely without requiring user interaction. The vulnerability is classified under CWE-256, which relates to the use of hard-coded or weak credentials or insufficient access control mechanisms. The attack vector is network-based (AV:N), meaning it can be exploited remotely over the network. The vulnerability affects the confidentiality, integrity, and availability of the device, as arbitrary command execution can lead to data leakage, unauthorized modifications, or denial of service. Although no public exploits are currently known, the high CVSS score (8.8) reflects the critical nature of this flaw. The affected device, Weintek cMT-3072XH2, is commonly used in industrial control systems and automation environments, making this vulnerability particularly concerning for operational technology (OT) networks. The lack of available patches at the time of publication increases the urgency for organizations to implement compensating controls.

Detailed information about CVE-2024-55026: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-55026: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-55026: n/a

A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges.

CVE-2024-55020 is a command injection vulnerability identified in the DHCP activation feature of the Weintek cMT-3072XH2 easyweb Web Version v2.1.53 running OS version v20231011. The flaw arises due to insufficient input validation and improper handling of user-supplied data within the DHCP activation process, allowing attackers to inject arbitrary shell commands. This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-20 (Improper Input Validation). The critical aspect of this vulnerability is that it can be exploited remotely over the network without any authentication or user interaction, granting attackers root-level privileges on the affected device. This level of access enables full control over the device, including the ability to alter configurations, disrupt operations, exfiltrate sensitive data, or use the device as a pivot point for further network compromise. The device in question, Weintek cMT-3072XH2, is commonly used in industrial automation and human-machine interface (HMI) applications, making this vulnerability particularly dangerous in operational technology (OT) environments. The CVSS v3.1 base score of 9.8 reflects the high impact and ease of exploitation. As of the publication date, no patches or official fixes have been released, and there are no known exploits actively used in the wild. This increases the urgency for organizations to implement interim protective measures. The vulnerability's root cause is a failure to properly sanitize inputs passed to system commands during DHCP activation, which attackers can leverage to execute arbitrary commands with root privileges, effectively compromising the device's confidentiality, integrity, and availability.

Detailed information about CVE-2024-55020: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-55020: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-55020: n/a


CVE-2024-55026: n/aCVE-2024-55026 0 An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request. HighVulnerabilityUnited StatesGermanyChina+8#cve #cve-2024-55026 Join the discussion	CVE Database V5	03/03/2026, 00:00:00 UTC Added: 03/03/2026, 18:48:22 UTC
CVE-2024-55020: n/aCVE-2024-55020 0 A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute arbitrary commands with root privileges. CriticalVulnerabilityUnited StatesGermanyJapan+8#cve #cve-2024-55020 Join the discussion	CVE Database V5	03/03/2026, 00:00:00 UTC Added: 03/03/2026, 18:48:22 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional