Remote Code Execution in TongWeb 7.0.24

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: MITRE

Description

An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimdall endpoint

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-25

Generated

2026-08-26

AI Q&A

2026-08-26

EPSS Evaluated

N/A

NVD

CVE-2026-51368

Affected Vendors & Products

Vendor	Product	Version / Range
beijing_tongtech_co_ltd	tongweb	7.0.24

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Beijing Tongtech Co., Ltd tongweb v.7.0.24 software. It exists in the Spring HttpInovkerServiceExporter component and allows a remote attacker to execute arbitrary code by sending a specially crafted request to the console/heimdall endpoint.

Impact Analysis

An attacker could exploit this to run malicious code on the affected system, potentially gaining control over the server, stealing data, or disrupting services. Systems running tongweb v.7.0.24 are at risk if exposed to untrusted networks.

Mitigation Strategies

Immediately restrict access to the console/heimdall endpoint on systems running TongWeb v7.0.24. Update to the latest patched version if available. Monitor network traffic for suspicious requests targeting this endpoint.

Hi! I’m here to help you understand CVE-2026-51368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70