CVE-2024-50364

Summary

CVE-2024-5364 represents a critical OS Command Injection vulnerability affecting select devices from Advantech: EKI-6333AC-2G (version 1.6.3 and below), EKI-6333AC-2GD (version 1.6.3 and below), and EKI-6333AC-1GPO (version 1.2.1 and below. This vulnerability stems from the "export_log" API, where multiple input parameters are not adequately sanitized before being integrated into OS-level commands. Attackers can exploit this weakness to inject malicious OS commands, potentially leading to unauthorized access, data theft, or system compromise. Users are advised to update their devices to the latest security patches to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.