CVE-2024-50377

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability is associated to the backup configuration functionality that by default encrypts the archives using a static password.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-798

Affected software

VendorProductVersions
AdvantechEKI-6333AC-2G<= <= 1.6.3
AdvantechEKI-6333AC-2GD<= <= 1.6.3
AdvantechEKI-6333AC-1GPO<= <= 1.2.1
advantecheki-6333ac-2g_firmware<= 1.6.3
advantecheki-6333ac-2gd_firmware<= 1.6.3
advantecheki-6333ac-1gpo_firmware<= 1.2.1

References

Timeline

Published
Nov 26, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-503784.9Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit lCVE-2024-503799.8Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive fCVE-2024-50385.4The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up CVE-2024-503808.7Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices bCVE-2024-503818.8A vulnerability exists in Snap One OVRC cloud where an attacker can impersonate a Hub device and send requests to claim and unclaim devices.CVE-2024-503825.9Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in CVE-2024-503835.9Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna12CVE-2024-503847.5A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A speCVE-2024-503857.5A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A speCVE-2024-503869.9Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deployiCVE-2024-503879.8A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could alloCVE-2024-503889.8An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remo