PT-2023-5337 · Advantech · Eki-1524+2

S. Dietz

+3

·

Published

2023-05-08

·

Updated

2023-05-12

·

CVE-2023-2574

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21
Description The issue is related to a command injection vulnerability in the device name input field. This vulnerability can be triggered by authenticated users via a crafted POST request to exploit the vulnerability, allowing remote attackers to execute arbitrary commands. The vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command.
Recommendations For Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21, consider disabling the device name input field until a patch is available to prevent exploitation. Restrict access to the vulnerable input field to minimize the risk of exploitation. Avoid using the device name input field in crafted POST requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2023-05965
CVE-2023-2574

Affected Products

Eki-1521
Eki-1522
Eki-1524