CVE-2024-50363
📋 TL;DR
This OS command injection vulnerability in Advantech EKI-6333 series industrial switches allows attackers to execute arbitrary commands on affected devices by exploiting unsanitized parameters in the mp_apply API. Organizations using these switches in industrial control systems or network infrastructure are affected. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Advantech EKI-6333AC-2G
- Advantech EKI-6333AC-2GD
- Advantech EKI-6333AC-1GPO
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device takeover allowing attacker to modify network configurations, intercept traffic, install persistent backdoors, or pivot to other industrial control systems.
Likely Case
Unauthorized command execution leading to service disruption, configuration changes, or credential theft from the device.
If Mitigated
Limited impact if devices are isolated in protected networks with strict access controls and monitoring.
🎯 Exploit Status
Exploitation requires access to the web management interface. The vulnerability is in API parameters that are not properly sanitized before being used in OS commands.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: EKI-6333AC-2G > 1.6.3, EKI-6333AC-2GD > v1.6.3, EKI-6333AC-1GPO > v1.2.1
Vendor Advisory: https://www.advantech.com/support
Restart Required: Yes
Instructions:
1. Download latest firmware from Advantech support portal. 2. Backup current configuration. 3. Upload firmware via web interface. 4. Apply update and restart device. 5. Verify version after reboot.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected switches in protected network segments with strict firewall rules.
Access Control
allRestrict access to web management interface using firewall rules and authentication.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices
- Disable web management interface if not required, use console access only
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI. If version matches affected range, device is vulnerable.Check Version:
Check via web interface: System > Maintenance > Firmware or via CLI: show versionVerify Fix Applied:
Verify firmware version is above affected versions after patching. Test mp_apply API with sanitized input validation.📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to mp_apply endpoint
- Suspicious command execution in system logs
- Multiple failed authentication attempts
Network Indicators:
- Unusual traffic patterns from switch management IP
- Unexpected outbound connections from switch
SIEM Query:
source="switch_logs" AND (uri="*mp_apply*" OR command="*sh*" OR command="*bash*")