CVE-2024-50359: OS Command Injection
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "scanap" API which are not properly sanitized before being concatenated to OS level commands.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50359?
CVE-2024-50359 has been classified as a high severity vulnerability due to its potential for OS command injection.
How do I fix CVE-2024-50359?
To fix CVE-2024-50359, upgrade to the latest firmware version provided by Advantech for the affected devices.
Which devices are affected by CVE-2024-50359?
CVE-2024-50359 affects the Advantech EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO devices running specified vulnerable versions.
What type of vulnerability is CVE-2024-50359?
CVE-2024-50359 is classified as an OS Command Injection vulnerability under CWE-78.
What are the potential impacts of CVE-2024-50359?
Exploitation of CVE-2024-50359 could allow attackers to execute arbitrary OS commands, leading to unauthorized access or control of the affected devices.