CVE-2026-73165

Nozomi Networks Labs identified an OS command injection flaw (CWE-78) in the web management interface of the Advantech EKI-1242IEIMS industrial device running firmware V1.06.01. A remote attacker who already holds valid credentials can submit crafted request parameters that the interface fails to neutralize before passing to the underlying operating system, resulting in execution of arbitrary OS commands. Because the injected commands run as root, a successful attacker gains full control of the device, which in OT deployments can serve as a foothold for pivoting into industrial network segments. Exploitation requires high-privileged authentication (CVSS 4.0 PR:H), so risk concentrates on deployments with weak, default, or stolen administrative credentials. No public proof-of-concept is known, the flaw is not in the CISA KEV catalog, and no exploitation has been reported.

What to do: Inventory for EKI-1242IEIMS devices running firmware V1.06.01 and contact Advantech for a patched firmware release, applying it as soon as available. Until then, restrict access to the web management interface to trusted management networks, enforce strong unique administrative credentials (change any defaults), and review device logs for unexpected authenticated requests with unusual parameter values. Network segmentation of OT zones will limit the impact of any root-level compromise.