PT-2024-9481 · Advantech · Advantech Eki-6333Ac-1Gpo+1

Diego Zaffaroni · Published 2024-11-26 · Updated 2024-11-26 · CVE-2024-50369

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Advantech EKI-6333AC-2G versions 1.6.3 and earlier Advantech EKI-6333AC-2GD versions 1.6.3 and earlier Advantech EKI-6333AC-1GPO versions 1.2.1 and earlier

Description: The issue exists due to the lack of neutralization of special elements used in an operating system command. This can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability relies on multiple parameters belonging to the "multiple ssid htm" API, which are not properly sanitized before being concatenated to OS-level commands.

Recommendations: For Advantech EKI-6333AC-2G versions 1.6.3 and earlier, update to a version later than 1.6.3. For Advantech EKI-6333AC-2GD versions 1.6.3 and earlier, update to a version later than 1.6.3. For Advantech EKI-6333AC-1GPO versions 1.2.1 and earlier, update to a version later than 1.2.1. As a temporary workaround, consider restricting access to the "multiple ssid htm" API to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-11181

CVE-2024-50369

Affected Products

Advantech Eki-6333Ac-1Gpo

Advantech Eki-6333Ac-2G

References · 6

• https://bdu.fstec.ru/vul/2024-11181 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-50369 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50369 · Vendor Advisory
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2024-50369 · Note
• https://t.me/latest_high_impact_cve/1569 · Telegram Post
• https://twitter.com/CVEnew/status/1861367575050952959 · Twitter Post