CVE-2026-19535
HighCVSS 8.6Summary
A CWE-352 Cross-Site Request Forgery vulnerability was identified in the LuCI administrative web interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote unauthenticated attacker can perform unauthorized state-changing requests on behalf of a logged-in administrator, enabling unauthorized access to privileged management functions.
Risk Assessment
An attacker can trick an administrator into visiting a malicious website and perform administrative operations on their behalf, leading to unauthorized device configuration changes.
Recommendation
Update the firmware to a non-vulnerable version, log out of the administrative interface after use, and restrict access to the management panel.
Other vulnerabilities in Advantech EKI-1242IEIMS
See all- CVE-2026-73176High
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
- CVE-2026-73167High
A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.
- CVE-2026-73166High
A CWE-94 code injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary code on the device, including OS commands as root.
- CVE-2026-73165High
A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.
- CVE-2026-73164High
A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.
- CVE-2026-73163High
A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to perform unauthorized state-changing requests on behalf of a logged-in administrator, enabling unauthorized access to privileged management functions.