CVE-2024-50360: OS Command Injection
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "snmpapply" API which are not properly sanitized before being concatenated to OS level commands.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50360?
CVE-2024-50360 is considered a high severity vulnerability due to its potential for OS command injection.
How do I fix CVE-2024-50360?
To fix CVE-2024-50360, update the affected devices to versions exceeding the specified vulnerable versions: EKI-6333AC-2G and EKI-6333AC-2GD to above 1.6.3, and EKI-6333AC-1GPO to above 1.2.1.
Which devices are affected by CVE-2024-50360?
CVE-2024-50360 affects Advantech devices EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO with specific versions.
What type of vulnerability is CVE-2024-50360?
CVE-2024-50360 is an OS Command Injection vulnerability classified as CWE-78, which involves improper neutralization of special elements.
Can CVE-2024-50360 be exploited remotely?
Yes, CVE-2024-50360 can potentially be exploited remotely, allowing attackers to execute arbitrary commands on the affected devices.