Critical severity · published Nov 26, 2024
CVE-2024-50371
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech:…
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "wlan_scan" operation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
Eki-6333ac-1gpo Firmware · Advantech
before 1.2.2 · source: NVD
EF
Eki-6333ac-2g Firmware · Advantech
before 1.6.5 · source: NVD
EF
Eki-6333ac-2gd Firmware · Advantech
before 1.6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-50371
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-50371
Third Party Advisory
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50371
More from Eki-6333ac-1gpo Firmware
9.8
CVE-2024-50375
A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<=…
9.8
CVE-2024-50374
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech:…
9.8
CVE-2024-50373
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech:…
9.8
CVE-2024-50372
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech:…
9.8
CVE-2024-50370
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech:…