Use of Hard-coded Cryptographic Key

CVE-2024-50358

Summary

A CWE-15 “External Control of System or Configuration Setting” was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by authenticated users by restoring a tampered configuration backup.

Impact

Authenticated users can perform Privilege Escalation and gain root capabilities over the restricted OpenWRT OS by restoring a tampered configuration backup.

Issue Date

November 26, 2025

Affects

The following products and firmware versions are affected: EKI-6333AC-2G ≤ v1.6.3 EKI-6333AC-2GD ≤ v1.6.3 EKI-6333AC-1GPO ≤ v1.2.1

CVE Name

CVE-2024-50358

CVSS Details

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS Score

7.2

Solution

Update affected products to the following firmware versions released by Advantech: - EKI-6333AC-2G: v1.6.5 - EKI-6333AC-2GD: v1.6.5 - EKI-6333AC-1GPO: v1.2.2

Mitigations

Acknowledgements

Diego Zaffaroni of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more

Latest Labs Blogs

Detecting New OT Threats: How To Do It Proactively 

Read

Smile, You’re Being Hacked: Nozomi Networks Labs Finds Five New Flaws in Hanwha Wisenet Cameras

Read

Breaking the Encryption: Analyzing the AutomationDirect CLICK Plus PLC Protocol 

Read
View All

Take the next step.

Discover how easy it is to identify and respond to cyber threats by automating your OT and IoT asset discovery, inventory, and management.