CVE-2026-73163
HighCVSS 8.6Summary
A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.
Risk Assessment
An authenticated attacker can gain full control of the device operating system as root, posing a critical threat to network infrastructure.
Recommendation
Immediately update the firmware to a fixed version, restrict web interface access to trusted networks, and change default credentials.
Other vulnerabilities in Advantech EKI-1242IEIMS
See all- CVE-2026-73176High
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
- CVE-2026-73167High
A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.
- CVE-2026-73166High
A CWE-94 code injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary code on the device, including OS commands as root.
- CVE-2026-73165High
A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.
- CVE-2026-73164High
A CWE-78 OS command injection vulnerability was identified in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary OS commands as root via crafted request parameters.
- CVE-2026-19535High
A CWE-352 Cross-Site Request Forgery vulnerability was identified in the LuCI administrative web interface of Advantech EKI-1242IEIMS firmware V1.06.01. A remote unauthenticated attacker can perform unauthorized state-changing requests on behalf of a logged-in administrator, enabling unauthorized access to privileged management functions.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.