CVE-2024-50370
📋 TL;DR
This is a critical OS command injection vulnerability in Advantech wireless access points that allows remote unauthenticated attackers to execute arbitrary commands with root privileges. The vulnerability affects specific EKI-6333AC series devices and is exploitable via the default 'edgserver' service without authentication. Attackers can gain complete control of affected devices over the network.
💻 Affected Systems
- Advantech EKI-6333AC-2G
- Advantech EKI-6333AC-2GD
- Advantech EKI-6333AC-1GPO
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, exfiltrate data, or use devices as botnet nodes.
Likely Case
Remote code execution leading to device takeover, network reconnaissance, and lateral movement within the network.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
The vulnerability is in a specific operation (cfg_cmd_set_eth_conf) and requires no authentication, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Advantech security advisory for specific patched versions
Vendor Advisory: https://www.advantech.com/support
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Advantech support portal. 3. Upload firmware via web interface. 4. Apply firmware update. 5. Reboot device.
🔧 Temporary Workarounds
Disable edgserver service
allDisable the vulnerable service if not required for functionality
Check device documentation for service management commands
Network segmentation
allIsolate affected devices in separate VLANs with strict firewall rules
🧯 If You Can't Patch
- Implement strict network access controls to limit access to affected devices
- Monitor network traffic to/from affected devices for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI and compare against vulnerable versionsCheck Version:
Check via web interface or consult device documentation for CLI version commandVerify Fix Applied:
Verify firmware version is updated beyond vulnerable versions and test if edgserver service responds to exploitation attempts📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Failed authentication attempts to edgserver service
- Unexpected process creation
Network Indicators:
- Unusual traffic to port used by edgserver service
- Suspicious payloads in network traffic to affected devices
SIEM Query:
Search for network connections to port [edgserver_port] from unexpected sources OR device logs containing 'cfg_cmd_set_eth_conf' with suspicious parameters