# Gessler WEB-MASTER hardcoded credentials and weak crypto

Published: 2025-08-07 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/5e05880d-829e-5be8-9516-6f34801f7598/gessler-web-master-hardcoded-credentials-and-weak-crypto

> Emergency lighting system WEB-MASTER 7.9 contains hardcoded credentials and weak password hashing; remote takeover possible.

Gessler GmbH WEB-MASTER, an emergency lighting management system deployed worldwide in critical manufacturing, contains two vulnerabilities affecting version 7.9. CVE-2024-1039 is a hardcoded credential flaw in a restoration account that allows unauthenticated remote attackers to gain complete control of the web management interface with no attack complexity (CVSS 9.8). CVE-2024-1040 involves weak cryptographic hashing of user account passwords, allowing privileged attackers with device access to crack stored password hashes and recover credentials (CVSS 4.4). The vulnerabilities were reported by Limes Security researchers.

No active exploitation has been reported to CISA as of the advisory date. Mitigation requires updating EZ2 to version 3.2 or later and WEB-MASTER to version 4.4 or later; updates must be applied by Gessler technicians. Defenders in critical manufacturing sectors should prioritize patching given the remote exploitability and full-control impact of CVE-2024-1039.

## Mentioned in this report

- Vulnerabilities: CVE-2024-1039, CVE-2024-1040

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5e05880d-829e-5be8-9516-6f34801f7598/gessler-web-master-hardcoded-credentials-and-weak-crypto.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup