CVE-2026-73167

Advantech EKI-1242IEIMS firmware V1.06.01 contains a CWE-78 OS command injection flaw in its web management interface, identified by Nozomi Networks Labs. An attacker who holds valid credentials can send crafted request parameters to the web interface, causing arbitrary operating system commands to be executed on the device with root privileges. Successful exploitation yields complete control of the gateway, including its configuration and any network connectivity it bridges, which is particularly significant in industrial OT environments. Only deployments of the EKI-1242IEIMS running the affected firmware are impacted, and exploitation requires authentication, limiting the attacker pool to users or anyone with compromised credentials. The issue is not listed in CISA KEV and no public proof-of-concept is known, so exploitation has not been observed.

What to do: Update the EKI-1242IEIMS to a firmware release fixed for this issue once Advantech publishes one (V1.06.01 is confirmed vulnerable). Until then, restrict the web management interface to trusted management VLANs or VPN access, minimize and rotate privileged accounts since authentication is the only barrier, and review device logs for unexpected requests or anomalous command execution tied to the web interface.