Loading story…
Advantech released security updates for EKI-series industrial wireless access points after researchers disclosed 20 vulnerabilities, including six critical flaws tracked as CVE-2024-50370 through CVE-2024-50375. The most severe issues affect over-the-air functionality and can let a remote, unauthenticated attacker bypass authentication, execute arbitrary code as root, and take full control of exposed devices.
The affected products are EKI-6333AC-2G and EKI-6333AC-2GD running firmware earlier than v1.6.5, and EKI-6333AC-1GPO running firmware earlier than v1.2.2. Additional high-severity weaknesses could enable cross-site scripting, system command injection, denial of service, and unauthorized access to sensitive data. Defenders are advised to immediately upgrade firmware to the vendor-fixed versions and review internet-exposed or operational technology deployments using these access points.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Advantech released security updates to fix 20 vulnerabilities in EKI-series industrial wireless access points. The fixes apply to EKI-6333AC-2G and EKI-6333AC-2GD before firmware v1.6.5 and EKI-6333AC-1GPO before firmware v1.2.2.
Nozomi Networks reported over-the-air vulnerabilities affecting Advantech EKI industrial wireless access points, including six critical flaws tracked as CVE-2024-50370 through CVE-2024-50375. The issues could allow unauthenticated attackers to bypass authentication, execute code as root, and fully compromise affected devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several high-severity vulnerabilities were disclosed across IoT/OT infrastructure products, creating pathways to **unauthenticated remote code execution** or full device compromise. **Ruckus vRIoT IoT Controller** was reported to contain two **CVSS 10.0** issues—`CVE-2025-69425` and `CVE-2025-69426`—driven by **hardcoded secrets/credentials** that enable attackers to bypass authentication and obtain **root-level command execution**, including via a service listening on **TCP port 2004**. Separately, Singapore’s **CSA** issued a high-priority alert for **Advantech** software affected by a **CVSS 10.0 SQL injection** (`CVE-2025-52694`) that allows an **unauthenticated remote attacker** to execute arbitrary SQL commands against exposed services, impacting multiple *IoTSuite* and *IoT Edge* components and requiring upgrades (some obtained via vendor support channels).
Jun 29, 2026
A set of critical vulnerabilities has been identified in the METZ CONNECT EWIO2 series, including models EWIO2-M, EWIO2-M-BM, and EWIO2-BM running firmware versions below 2.2.0. The most severe issue is an authentication bypass (CVE-2025-41733/41734) that allows unauthenticated attackers with network access to gain administrative control over the device. Exploitation enables attackers to change configurations, manipulate data, disrupt services, and potentially render the device inoperable. Additional vulnerabilities include improper control of filename for include/require statements, unrestricted upload of dangerous file types, path traversal, and improper access control, collectively enabling remote code execution and full device compromise. CISA has issued an ICS advisory (ICSA-25-322-05) highlighting the remote exploitability and low attack complexity of these flaws, assigning a CVSS v4 base score of 9.3. The vulnerabilities stem from the commissioning wizard failing to validate device initialization, allowing attackers to set root credentials via crafted POST requests. Organizations using affected METZ CONNECT EWIO2 devices are urged to review technical details and apply mitigations to prevent unauthorized access and maintain device integrity and availability.
Jun 29, 2026
Advantech WebAccess/SCADA has been found to contain several critical vulnerabilities, including an unrestricted file upload flaw (CVE-2025-14849) and a directory traversal vulnerability (CVE-2025-14850). The unrestricted file upload issue could allow a remote attacker to execute arbitrary code on affected systems, while the directory traversal flaw may enable attackers to delete arbitrary files. Both vulnerabilities are remotely exploitable and have been assigned high CVSS scores, indicating significant risk to organizations using this software in critical infrastructure sectors. CISA has issued an advisory confirming that these vulnerabilities affect Advantech WebAccess/SCADA version 9.2.1, and recommends updating to version 9.2.2 to mitigate the risks. The vulnerabilities impact organizations in sectors such as critical manufacturing, energy, and water and wastewater, with deployments worldwide. Exploitation of these flaws could allow authenticated attackers to read or modify remote databases, potentially leading to severe operational disruptions.
Jun 29, 2026