Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Advantech EKI-6333 devices allow remote attackers to execute commands

CVE-2024-50368 · published 1 year ago
Summary

Certain Advantech devices have a security flaw that allows remote attackers to execute arbitrary system commands, which can lead to unauthorized access or data destruction. This vulnerability affects devices with version 1.6.3 or earlier of the EKI-6333AC-2G, version 1.6.3 or earlier of the EKI-6333AC-2GD, and version 1.2.1 or earlier of the EKI-6333AC-1GPO. Users should update their devices to the latest version to fix this issue.

What to do
  • Update advantech eki-6333ac-2g_firmware to version 1.6.5 or later.
  • Update advantech eki-6333ac-2gd_firmware to version 1.6.5 or later.
  • Update advantech eki-6333ac-1gpo_firmware to version 1.2.2 or later.
Affected software
VendorProductAffected versions
advantech eki-6333ac-2g_firmware < 1.6.5
cpe:2.3:o:advantech:eki-6333ac-2g_firmware:*:*:*:*:*:*:*:*
advantech eki-6333ac-2gd_firmware < 1.6.5
cpe:2.3:o:advantech:eki-6333ac-2gd_firmware:*:*:*:*:*:*:*:*
advantech eki-6333ac-1gpo_firmware < 1.2.2
cpe:2.3:o:advantech:eki-6333ac-1gpo_firmware:*:*:*:*:*:*:*:*
Original advisory text
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6...
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "basic_htm" API which are not properly sanitized before being concatenated to OS level commands.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.2 High
Exploitation
1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published26 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-50368 · NVD
Track software like this
Free during beta