Advantech Devices Vulnerable to OS Command Injection

CVE-2024-50371

Summary

A vulnerability has been identified that permits OS Command Injection in specific Advantech networking devices. This issue arises from improper neutralization of special elements, allowing remote unauthenticated users to exploit the default 'edgserver' service. The vulnerability enables attackers to execute malicious commands with root privileges, significantly compromising the security of the devices. The flaw is attributed to improper handling of code related to the 'wlan_scan' operation, which allows unauthorized access without any authentication mechanisms in place.

References