CVE-2024-50377 | Nozomi Networks Labs

Summary

A CWE-798 “Use of Hard-coded Credentials” was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability is associated to the backup configuration functionality that by default encrypts the archives using a static password.

Impact

The hardcoded secret can be used craft a malicious backup configuration later restored inside the access point.

Issue Date

November 26, 2025

Affects

The following products and firmware versions are affected: EKI-6333AC-2G ≤ v1.6.3 EKI-6333AC-2GD ≤ v1.6.3 EKI-6333AC-1GPO ≤ v1.2.1

CVE Name

CVE-2024-50377

CVSS Details

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

CVSS Score

6.5

Solution

Update affected products to the following firmware versions released by Advantech: - EKI-6333AC-2G: v1.6.5 - EKI-6333AC-2GD: v1.6.5 - EKI-6333AC-1GPO: v1.2.2

Mitigations

Acknowledgements

Diego Zaffaroni of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more