CVE-2026-73166

Nozomi Networks Labs identified a CWE-94 code injection flaw in the web management interface of the Advantech EKI-1242IEIMS running firmware V1.06.01. A remote attacker who is already authenticated with high-privilege (administrator-level) access to the web interface can inject and execute arbitrary code, including operating-system commands that run as root. Successful exploitation yields full control of the device, with high impact on its confidentiality, integrity and availability (CVSS 4.0 score 8.6 High). Only deployments of EKI-1242IEIMS on the affected firmware are exposed, and the attack requires valid administrative credentials, which lowers the practical risk compared with unauthenticated flaws. The issue is not listed in CISA KEV, no public proof-of-concept is known, and no exploitation has been reported in the wild.

What to do: Inventory deployed EKI-1242IEIMS units and check the firmware version; units on V1.06.01 should be updated to the latest firmware from Advantech once a fixed release is published. In the meantime, restrict access to the web management interface to trusted management networks or VPN and audit which accounts hold high-privilege credentials, since exploitation requires authenticated administrator access. Monitor Advantech and Nozomi Networks advisories for patch availability and any added indicators of compromise.