CVE-2026-73164

Advantech EKI-1242IEIMS firmware version V1.06.01 contains a CWE-78 OS command injection flaw in its web management interface, identified by Nozomi Networks Labs. A remote attacker who already holds authenticated (high-privilege) access can send crafted request parameters to the web interface, causing the device to execute arbitrary operating system commands. Because the injected commands run as root, the attacker gains full control of the gateway, including its configuration and any traffic it bridges in the OT/industrial network. Only deployments running the affected Advantech EKI-1242IEIMS firmware with the web management interface reachable and valid admin credentials available are exposed. There is currently no evidence of exploitation: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: Check deployed EKI-1242IEIMS units for firmware V1.06.01 and apply the vendor's fixed firmware as soon as Advantech publishes it; no fixed version is specified in the current advisory data. Until then, restrict access to the web management interface to trusted management VLANs or allowlisted admin hosts, minimize the number of accounts with admin rights, and monitor for unusual authenticated requests to the device. Since no public PoC or in-the-wild exploitation is known, remediation can be scheduled in the normal maintenance cycle but should not be deferred indefinitely.