CVE-2024-50372

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50372
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the "backup_config_to_utility" operation.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50372 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:advantech:eki-6333ac-2g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:advantech:eki-6333ac-2g:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:advantech:eki-6333ac-2gd_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:advantech:eki-6333ac-2gd:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:advantech:eki-6333ac-1gpo_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:advantech:eki-6333ac-1gpo:-:*:*:*:*:*:*:*
History

23 Jan 2026, 18:12

Type Values Removed Values Added
References () https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50372 - () https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50372 - Third Party Advisory
Summary
  • (es) Se descubrió una vulnerabilidad CWE-78 "Neutralización incorrecta de elementos especiales utilizados en un comando del SO ('Inyección de comando del SO')" que afecta a los siguientes dispositivos fabricados por Advantech: EKI-6333AC-2G (&lt;= 1.6.3), EKI-6333AC-2GD (&lt;= v1.6.3) y EKI-6333AC-1GPO (&lt;= v1.2.1). La vulnerabilidad puede ser explotada por usuarios remotos no autenticados capaces de interactuar con el servicio "edgserver" predeterminado habilitado en el punto de acceso y se ejecutan comandos maliciosos con privilegios de superusuario. No hay autenticación habilitada en el servicio y la fuente de la vulnerabilidad reside en el código de procesamiento asociado a la operación "backup_config_to_utility".
First Time Advantech eki-6333ac-1gpo
Advantech eki-6333ac-2g Firmware
Advantech
Advantech eki-6333ac-1gpo Firmware
Advantech eki-6333ac-2g
Advantech eki-6333ac-2gd Firmware
Advantech eki-6333ac-2gd
CPE cpe:2.3:h:advantech:eki-6333ac-1gpo:-:*:*:*:*:*:*:*
cpe:2.3:o:advantech:eki-6333ac-1gpo_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:advantech:eki-6333ac-2g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:advantech:eki-6333ac-2g:-:*:*:*:*:*:*:*
cpe:2.3:o:advantech:eki-6333ac-2gd_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:advantech:eki-6333ac-2gd:-:*:*:*:*:*:*:*

26 Nov 2024, 11:22

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-26 11:22

Updated : 2026-01-23 18:12

NVD link : CVE-2024-50372

Mitre link : CVE-2024-50372

CVE.ORG link : CVE-2024-50372

JSON object : View

Products Affected

advantech

  • eki-6333ac-2g
  • eki-6333ac-2gd
  • eki-6333ac-2gd_firmware
  • eki-6333ac-1gpo
  • eki-6333ac-2g_firmware
  • eki-6333ac-1gpo_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')