Nozomi Finds IoT Vulnerabilities in Advantech Products – Patch Required

Industrial networks are increasingly adopting wireless technologies, but this shift brings new security challenges. Nozomi Networks has uncovered a series of vulnerabilities in Advantech’s EKI-6333AC-2G wireless access points, exposing critical infrastructure to cyber risks.

These vulnerabilities, identified in firmware version 1.6.2, allow unauthenticated remote code execution with root privileges, threatening the confidentiality, integrity, and availability of affected devices. Nozomi Networks Labs disclosed the findings after a comprehensive analysis, uncovering 20 distinct vulnerabilities.

Advantech responded by releasing firmware updates for its EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO devices, addressing the identified issues. The vulnerabilities were discovered across shared firmware code used by these models.

Critical Risks Identified

The EKI-6333AC-2G is designed for industrial environments where reliability and secure connections are crucial. These vulnerabilities, however, create two major attack vectors: direct network exploitation and over-the-air attacks.

In one scenario, attackers could interact directly with the device over the network (LAN or WAN) to exploit the vulnerabilities. The second scenario is more concerning, as attackers can exploit the wireless spectrum without connecting to the network, simply by being in physical proximity to the device.

“These vulnerabilities highlight the need for industrial-grade wireless devices to have robust security measures,” said a Nozomi Networks representative. “The risks include persistent backdoor access, denial-of-service attacks, and lateral movement within the network.”

Real-World Impacts

If exploited, the vulnerabilities allow attackers to gain root access, enabling them to compromise other connected systems. Nozomi Networks outlined three key risks:

• Persistent access: Attackers can install backdoors for ongoing access, enabling further malware infections or network compromise.
  
  
• Denial of Service (DoS): Disrupting wireless access points could halt automated systems reliant on these devices, such as warehouse robots or production line machinery.
  
  
• Lateral movement: With root access, attackers can use the compromised device to launch man-in-the-middle attacks or exploit unpatched devices within the network.

Over-the-Air Attack Details

Nozomi Networks detailed an over-the-air attack scenario involving two vulnerabilities: CVE-2024-50376 and CVE-2024-50359. These vulnerabilities, when exploited together, enable arbitrary code execution via the device’s wireless spectrum.

CVE-2024-50376 is a cross-site scripting (XSS) flaw that lets attackers inject JavaScript code into the device’s management interface. By broadcasting rogue beacon frames containing malicious SSIDs, attackers can trigger this vulnerability. CVE-2024-50359, an authenticated command injection vulnerability, can then be used to gain deeper control of the system.

In practical terms, an attacker would broadcast malicious beacon frames from a rogue access point near the target device. If an administrator visits the device’s Wi-Fi analyser section, the malicious code executes, allowing the attacker to take control.

Broader Security Implications

Once a device is compromised, the attacker could implant a backdoor, run arbitrary commands, or establish a reverse shell to maintain remote access. These actions could lead to further infiltration of the network, data theft, or deployment of additional malware.

“This type of attack demonstrates how even physically isolated networks can be at risk,” the representative added. “Industrial operators need to be aware of the cascading effects such vulnerabilities can have on their systems.”

Firmware Updates Released

Advantech has addressed the vulnerabilities by releasing new firmware versions for the affected devices:

• EKI-6333AC-2G: Version 1.6.5
• EKI-6333AC-2GD: Version 1.6.5
• EKI-6333AC-1GPO: Version 1.2.2

Operators using these devices are urged to apply the updates immediately to mitigate the risks.

Last Updated on November 28, 2024 by Nick Ross