CVE-2023-2573

Deeper analysis

Advantech EKI-1524, EKI-1522, and EKI-1521 devices through firmware version 1.21 contain a command injection vulnerability in the NTP server input field. The flaw, tracked as CVE-2023-2573 and assigned CVSS 8.8, stems from improper handling of user-supplied values that are passed to system commands, corresponding to CWE-78 and CWE-77. It is reachable over the network through a crafted POST request.

Authenticated users can exploit the issue by submitting malicious input in the NTP configuration field, resulting in arbitrary command execution on the device with the ability to read, modify, or delete data and potentially disrupt industrial operations. No special user interaction is required beyond valid credentials.

Vendor advisories from Advantech point to updated firmware releases that address the NTP input handling, available via the support pages for the affected EKI-15xx models. Public disclosures also reference proof-of-concept material that demonstrates the injection vector.

The EPSS score reached a peak of 0.0707 in January 2025 before receding to the current value of 0.0460, indicating modest post-disclosure interest without evidence of widespread exploitation in the provided data.