CVE-2026-51368: Beijing Tongtech Co., Ltd tongweb vulnerability

Published Aug 25, 2026

Updated

An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimdall endpoint

Affected Software

1 affected component

Beijing Tongtech Co., Ltd tongweb=7.0.24

Event History

Aug 25, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·09:17 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue is described as remotely exploitable through a crafted request to the console/heimdall endpoint. The available information does not state that authentication or prior access is required.

Which deployments should be prioritized for investigation?

Prioritize Tongweb version 7.0.24 deployments where the console/heimdall endpoint is reachable by remote clients, because that endpoint is identified as the attack path.

How can I determine whether an instance may be affected?

Verify whether the server is Beijing Tongtech Tongweb version 7.0.24 and whether it exposes the console/heimdall endpoint using the Spring HttpInovkerServiceExporter component. The provided data does not include detection signatures, logs, or indicators of compromise.

CVE-2026-51368: Beijing Tongtech Co., Ltd tongweb vulnerability

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments should be prioritized for investigation?

How can I determine whether an instance may be affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments should be prioritized for investigation?

How can I determine whether an instance may be affected?