CVE-2024-50364: OS Command Injection
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "exportlog" API which are not properly sanitized before being concatenated to OS level commands.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50364?
CVE-2024-50364 is considered a high-severity vulnerability due to its potential for OS command injection.
How do I fix CVE-2024-50364?
To address CVE-2024-50364, upgrade the affected devices to versions above EKI-6333AC-2G and EKI-6333AC-2GD v1.6.3, and EKI-6333AC-1GPO v1.2.1.
Which devices are affected by CVE-2024-50364?
CVE-2024-50364 affects Advantech devices including EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= 1.6.3), and EKI-6333AC-1GPO (<= 1.2.1).
What causes the vulnerability in CVE-2024-50364?
CVE-2024-50364 is caused by improper neutralization of special elements used in OS commands, allowing for potential command injection.
Can CVE-2024-50364 lead to data breaches?
Yes, if exploited, CVE-2024-50364 can lead to unauthorized access and potential data breaches.