CVE-2026-73176

The web management interface of the Advantech EKI-1242IEIMS industrial gateway contains a CWE-78 OS command injection flaw in firmware version V1.06.01. A remote attacker who already holds valid, high-privileged credentials can trigger it by sending requests with specially crafted parameters to the management interface. Because the injected commands run as root, successful exploitation yields full takeover of the device, including complete confidentiality, integrity, and availability impact on the gateway itself. Any deployment running the affected firmware is exposed, though exploitation requires an authenticated account, which limits attackers to insiders or credential compromise. As of this writing the issue is not in the CISA KEV catalog, no public proof-of-concept is known, and no in-the-wild exploitation has been reported.

What to do: Restrict access to the EKI-1242IEIMS web management interface to trusted management networks or VPNs, enforce strong admin credentials, and monitor for unexpected requests to the management interface. Contact Advantech for patched firmware once available, since no fixed version is identified in the current data. Audit administrator accounts for compromise, as exploitation requires valid high-privileged credentials.