CVE-2026-73163

Nozomi Networks Labs identified an OS command injection flaw (CWE-78) in the web management interface of the Advantech EKI-1242IEIMS industrial device. Firmware version V1.06.01 fails to properly neutralize special elements in request parameters, so a remote attacker who holds valid web-interface credentials can submit crafted parameter values that are executed by the underlying operating system. Successful exploitation yields arbitrary OS command execution with root privileges, meaning full compromise of the device, including its configuration and network position. Any organization running the affected firmware, typically in OT/industrial deployments, is exposed, with authentication being the main barrier to attack. The vulnerability is not listed in CISA KEV, no public proof-of-concept is known, and no exploitation has been observed in the wild.

What to do: Update EKI-1242IEIMS devices to the latest firmware available from Advantech, ensuring it is newer than V1.06.01 (the data does not name a specific fixed version, so confirm with the vendor's advisory). Until patched, restrict access to the web management interface to trusted management networks or VPNs, enforce strong credentials for all authenticated accounts, and review device logs for unexpected or suspicious authenticated sessions. Monitor the Nozomi Networks and Advantech advisories for fixes and for any additions to the affected-version list.