CVE-2024-50368: OS Command Injection
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the "basichtm" API which are not properly sanitized before being concatenated to OS level commands.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50368?
CVE-2024-50368 is classified as a high-severity vulnerability due to its potential for OS command injection.
How do I fix CVE-2024-50368?
To fix CVE-2024-50368, update the affected Advantech devices to versions later than EKI-6333AC-2G 1.6.3, EKI-6333AC-2GD 1.6.3, or EKI-6333AC-1GPO 1.2.1.
Which devices are affected by CVE-2024-50368?
CVE-2024-50368 affects Advantech devices including EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO with the specified versions.
What is OS Command Injection in the context of CVE-2024-50368?
In the context of CVE-2024-50368, OS Command Injection refers to the vulnerability allowing attackers to execute arbitrary operating system commands on the affected devices.
Is there a workaround for CVE-2024-50368?
Currently, the only reliable solution for CVE-2024-50368 is to apply the available software updates for the affected devices.