CVE-2024-50358 | Nozomi Networks Labs

Summary

A CWE-15 “External Control of System or Configuration Setting” was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by authenticated users by restoring a tampered configuration backup.

Impact

Authenticated users can perform Privilege Escalation and gain root capabilities over the restricted OpenWRT OS by restoring a tampered configuration backup.

Issue Date

November 26, 2025

Affects

The following products and firmware versions are affected: EKI-6333AC-2G ≤ v1.6.3 EKI-6333AC-2GD ≤ v1.6.3 EKI-6333AC-1GPO ≤ v1.2.1

CVE Name

CVE-2024-50358

CVSS Details

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS Score

7.2

Solution

Update affected products to the following firmware versions released by Advantech: - EKI-6333AC-2G: v1.6.5 - EKI-6333AC-2GD: v1.6.5 - EKI-6333AC-1GPO: v1.2.2

Mitigations

Acknowledgements

Diego Zaffaroni of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more