OS Command Injection Vulnerability in Advantech EKI-6333AC-2G Devices

CVE-2024-50365

Summary

A vulnerability was identified in specific Advantech networking devices that allows OS command injection through the 'lan_apply' API. This vulnerability occurs due to the failure to properly sanitize multiple parameters before they are concatenated to OS-level commands, enabling attackers to execute arbitrary OS commands. Affected devices include EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO, particularly those running versions prior to 1.6.3 and 1.2.1, respectively. Proper mitigation measures are essential to secure these devices from potential exploitation.

References