CVE-2024-50371

published 2024-11-26

CVE-2024-50371: A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices…

Priority P2 66 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "wlan_scan" operation.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
advantech	eki-6333ac-1gpo	<= <= 1.2.1	—
advantech	eki-6333ac-1gpo_firmware	< 1.2.2	1.2.2
advantech	eki-6333ac-2g	<= <= 1.6.3	—
advantech	eki-6333ac-2g_firmware	< 1.6.5	1.6.5
advantech	eki-6333ac-2gd	<= <= 1.6.3	—
advantech	eki-6333ac-2gd_firmware	< 1.6.5	1.6.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78