CVE-2024-50367: OS Command Injection
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "staloghtm" API which are not properly sanitized before being concatenated to OS level commands.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50367?
CVE-2024-50367 is classified as a high severity vulnerability due to OS command injection risks.
How do I fix CVE-2024-50367?
To fix CVE-2024-50367, update Advantech EKI-6333AC-2G and EKI-6333AC-2GD devices to version 1.6.4 or later, and EKI-6333AC-1GPO to version 1.2.2 or later.
Which devices are affected by CVE-2024-50367?
CVE-2024-50367 affects Advantech devices including EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO running specific versions.
What type of vulnerability is CVE-2024-50367?
CVE-2024-50367 is categorized as an OS command injection vulnerability defined by CWE-78.
What are the potential impacts of CVE-2024-50367?
The potential impacts of CVE-2024-50367 include unauthorized command execution and control over the affected devices.