Security Advisory

CVE-2023-2573: Advantech EKI-1500 Series Serial Device Server Authenticated Command Injection

Last updated:
  • CVE-2023-2573

CVE-2023-2573 is a command-injection vulnerability in the web interface of Advantech's EKI-1521, EKI-1522 and EKI-1524 serial device servers, a product class that attaches legacy RS-232/422/485 equipment to an Ethernet network; an authenticated user can submit a crafted POST request that writes shell metacharacters into the device's NTP server field, and that field is later executed by the operating system with root permissions, so NVD's own Primary analysis scores it 8.8 (high) on the CVSS v3.1 scale.

Vulnerability summary

8.8

High

4.8%

EPSS score (FIRST)

No

CISA KEV catalog

2023-05-08

Published

Vulnerability ID: CVE-2023-2573 · Source: NVD

Affected components

ComponentCPEVersion range
Advantech EKI-1500 series serial device server firmware—EKI-1521(-CE), EKI-1522(-CE) and EKI-1524(-CE) firmware through 1.21; fixed in firmware 1.26, published via Advantech's per-model firmware support pages

What does this mean for affected devices?

CVE-2023-2573 (CWE-77, command injection) affects Advantech's EKI-1500 series serial device servers. NVD's description states: "Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request" (NVD).

Researchers Thomas Weber and Sebastian Dietz of CyberDanube, who found and disclosed the issue, describe the EKI-1500 series as a device class that "can be attached to legacy systems via RS-232, RS-422 or RS-485," bridging serial equipment onto an Ethernet network. Their write-up explains the attack mechanics directly: "The web server is prone to two authenticated command injections via POST parameters," and for this specific flaw, "an attacker sets the name of the NTP server in the interface, intercepts the HTTP message before it can be sent to the device, modifies the message by replacing the desired name with a system command enclosed by ';' characters, then sends the message to the device, whose Operating System executes the command with root permissions" (CyberDanube: Multiple Vulnerabilities in Advantech EKI-15XX Series). The same researchers reported a related, separately-numbered stack-based buffer overflow in the same NTP field (CVE-2023-2575) and a second command-injection path via the device-name field (CVE-2023-2574). Advantech's own per-model firmware support pages confirm firmware 1.26 (released 2023-09-04) as the fixed release and firmware 1.24 as having resolved a related "memory corruption issue while setting NTP server larger than 63 bytes" (Advantech Firmware Support, EKI-1521-CE).

NVD's own Primary analysis assigns a CVSS v3.1 base score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, but requiring low (authenticated) privileges. CyberDanube's own CNA-submitted Secondary score for the same CVE is identical, 8.8 with the same vector; NVD classifies the weakness as CWE-77 (command injection) while CyberDanube's submission uses the narrower CWE-78 (OS command injection) (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.04751 (91.935th percentile) as of 2026-11-07 — well above median, consistent with a publicly documented, low-complexity exploitation path (CISA KEV, FIRST EPSS).

Operators of affected EKI-1521, EKI-1522 and EKI-1524 units should update to firmware 1.26 or later from Advantech's support portal, and in the meantime should restrict access to the device's web management interface to trusted, authenticated administrators only, since exploitation requires an authenticated session.

How to fix this class of issueThis advisory's weakness class is Command injection. Our practical guide covers how to detect, fix, verify and disclose it: How to fix command injection in embedded firmware.

Evidence

  • Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a command injection vulnerability in the NTP server input field, triggered by authenticated users via a crafted POST request. — NVD
  • The EKI-1500 series attaches legacy RS-232/422/485 equipment to Ethernet; an attacker intercepts the HTTP POST setting the NTP server name, replaces it with a shell command wrapped in ';' characters, and the device's OS executes it with root permissions. — CyberDanube: Multiple Vulnerabilities in Advantech EKI-15XX Series
  • Advantech's EKI-1521-CE firmware support page lists firmware 1.26 (2023-09-04) as the fixed release and firmware 1.24 as resolving a related memory-corruption issue in the NTP server field. — Advantech Firmware Support, EKI-1521-CE
  • NVD Primary CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, matching CyberDanube's own CNA-submitted Secondary score. — NVD
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.04751 (91.935th percentile) as of 2026-11-07. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2023-34873: MOBOTIX P3 and Mx6 Camera tcpdump Feature Authenticated Code ExecutionCVE-2023-34873: the built-in tcpdump diagnostic feature of MOBOTIX P3 and Mx6 series camera firmware fails to validate input, letting an authenticated user execute code on the device. NVD records only a third-party Secondary CVSS v4.0 score (8.7); it has not yet published its own Primary score.CVE-2023-39509: Bosch IP Camera Authenticated OS Command Injection — CVSS 7.2, High severityCVE-2023-39509: a command injection vulnerability in Bosch IP cameras of the CPP13 and CPP14 firmware families lets an authenticated user with administrative rights run arbitrary OS commands on the camera. NVD has published its own Primary CVSS v3.1 score of 7.2 (high), matching Bosch's own figure.CVE-2023-43959: Yealink SIP-T19P-E2 IP Phone Authenticated Command Injection via Ping Diagnostic — CVSS 8.8, High severityCVE-2023-43959: an attacker who is logged into the web interface of a Yealink SIP-T19P-E2 IP phone can inject operating-system commands through the network diagnostics ping/traceroute function and execute them with root privileges. NVD Primary CVSS 8.8; sourced to NVD, with proof-of-concept detail from independent security researchers.

Sources

  1. NVD
  2. CyberDanube: Multiple Vulnerabilities in Advantech EKI-15XX Series
  3. Advantech Firmware Support, EKI-1521-CE
  4. CISA KEV
  5. FIRST EPSS