CVE-2026-51368: Tongweb 7.0.24 lets attackers run code remotely

The Tongweb server version 7.0.24 has a flaw in its web console that can be triggered by a specially crafted request, allowing an outside attacker to run any program on the server. This could let the attacker steal data, disrupt operations, or install malicious software. Apply the vendor’s security update or upgrade to a newer version and restrict access to the console endpoint.

• https://gist.github.com/loseyourself1/726a3c9dfe53dd90f71cacb63d988766
• https://gist.github.com/loseyourself1/b3de4edf11994bb0a791e5f73bab421b