CVE-2024-50369

Summary

CVE-2024-50369 is a newly disclosed vulnerability affecting several Advantech devices: EKI-6333AC-2G (versions <= 1.6.3), EKI-6333AC-2GD (versions <= v1.6.3), and EKI-6333AC-1GPO (versions <= v1.2.1). This security issue is categorized as a CWE-78 vulnerability, or "OS Command Injection," due to the improper neutralization of special elements within OS commands. The root cause is traced back to the "multiple_ssid_htm" API, which fails to adequately sanitize multiple parameters that are subsequently concatenated into OS-level commands, creating a potential risk of remote code execution.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.