CVE-2026-73172

Advantech's EKI-1242EIMS edge gateway, in firmware version V1.06.01, contains an OS command injection flaw (CWE-78) in its edgserver management service. A remote, unauthenticated attacker can send specially crafted requests to TCP port 5058 to inject and execute arbitrary operating system commands on the device. Because the injected commands run with root privileges, a successful exploit gives the attacker full control of the gateway, which is typically positioned to bridge IT and OT/industrial network segments. Any deployed EKI-1242EIMS running firmware V1.06.01 is affected, particularly units where port 5058 is reachable from untrusted networks. No exploitation in the wild, public proof-of-concept code, or KEV listing is known as of this analysis.

What to do: Check deployed EKI-1242EIMS devices and upgrade to a firmware version newer than V1.06.01 as soon as Advantech publishes a fix. In the meantime, restrict access to TCP port 5058 with firewall/ACL rules so only trusted management hosts can reach it, and review logs for unexpected connections to that port. Treat any gateway exposed to the internet on port 5058 as high priority to remediate, given the pre-authentication, root-level nature of the flaw.