OS Command Injection Vulnerability Affects Advantech Devices

CVE-2024-50367

Summary

A vulnerability exists in certain Advantech network devices due to improper neutralization of special elements used in OS command execution. This flaw is rooted in the 'sta_log_htm' API, where multiple parameters are not adequately sanitized before being incorporated into OS-level commands. This oversight could enable attackers to execute arbitrary OS commands, potentially compromising the integrity and security of connected systems. The affected devices include EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO, all of which are running versions below specified thresholds.

References