OS Command Injection Vulnerability Affects Multiple Advantech Devices

CVE-2024-50364

Summary

A security vulnerability has been identified in specific Advantech EKI series devices, stemming from improper handling of API parameters within the 'export_log' functionality. This oversight allows attackers to inject malicious commands into the operating system, potentially compromising the integrity and security of the affected systems. The flaw arises from the failure to adequately sanitize user inputs before integrating them into system-level commands. As a result, devices like EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO are at risk, highlighting the critical need for prompt updates and security measures to mitigate potential exploitation in operational environments.

References