CVE-2024-50377

Katalog CVE

CVSS 6.5 · Medium EPSS 0,19%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada advantech eki-6333ac-2g firmware, advantech eki-6333ac-2gd firmware +1 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut nozominetworks.com.

Deskripsi (NVD)

A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability is associated to the backup configuration functionality that by default encrypts the archives using a static password.

Rincian

Terbit di NVD

26 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber nozominetworks.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-50377 advisory pihak ketiga