Advantech EKI-6333AC-2G Vulnerable to OS Command Injection

CVE-2024-50374

Summary

A vulnerability identified as improper neutralization of special elements used in an OS command, known as OS Command Injection, has been found in Advantech EKI access points. Remote unauthenticated users can exploit this flaw through the default 'edgserver' service enabled on the access points. Malicious commands executed via this attack can run with root privileges, posing significant security risks. The issue arises from how the 'capture_packages' operation processes input, allowing for unauthorized command execution and potentially compromising system integrity.

References