9.8

CVE-2024-50375

A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default "edgserver" service enabled on the access point.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Advantech ≫ Eki-6333ac-2g Firmware Version < 1.6.5
   Advantech ≫ Eki-6333ac-2g Version-
Advantech ≫ Eki-6333ac-2gd Firmware Version < 1.6.5
   Advantech ≫ Eki-6333ac-2gd Version-
Advantech ≫ Eki-6333ac-1gpo Firmware Version < 1.2.2
   Advantech ≫ Eki-6333ac-1gpo Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.677
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
prodsec@nozominetworks.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.