OS Command Injection Vulnerability Affects Advantech Devices

CVE-2024-50361

Summary

An OS Command Injection vulnerability has been identified in several Advantech EKI devices. This security flaw arises from improper sanitization of multiple parameters within the 'certificate_file_remove' API, allowing attackers to manipulate OS-level commands. Devices affected by this vulnerability include the EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO, particularly those running versions of firmware below the specified thresholds. This could facilitate unauthorized command execution, posing significant security risks to users and networks reliant on these systems.

References