The vulnerability resides in the Spring HttpInovkerServiceExporter component of Beijing Tongtech Co., Ltd tongweb v.7.0.24. A crafted request to the console/heimdall endpoint can trigger arbitrary code execution due to insecure deserialization. This flaw enables an attacker to run code with the same privileges as the web application, potentially compromising the entire system. The weakness is categorized as CWE-502.

Beijing Tongtech Co., Ltd tongweb, version 7.0.24, is the only product version listed in the CVE. No other versions are specifically enumerated.

The CVSS score of 9.8 indicates critical severity, while the EPSS score is below 1%, implying limited real‑world exploitation so far. The vulnerability is not included in the CISA KEV catalog. Attackers can reach the console/heimdall endpoint over the network and submit a malicious payload; based on the description, it is inferred that no local privileges or authentication are required, so exposed installations are at high risk if patched is not applied. The weakness originates from insecure deserialization, allowing arbitrary code execution.