Remote Code Execution Vulnerability in Advantech EKI-6333AC-2G Devices

CVE-2024-50373

Summary

A vulnerability related to improper neutralization of special elements utilized in an OS command was identified in multiple Advantech EKI series devices. This vulnerability enables remote unauthenticated users to exploit the default 'edgserver' service on the affected devices, which processes commands with root privileges. The flaw is rooted in the code responsible for the 'restore_config_from_utility' function, exposing the affected devices to execution of malicious commands and potential unauthorized access to system controls.

References