CVE-2026-73164: OS Command Injection
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A remote attacker who has authenticated access to the device's web management interface can exploit it. The attacker does not need local access because the issue is reachable through crafted request parameters sent to the web interface.
What level of access could an attacker gain?
Successful exploitation allows execution of arbitrary operating-system commands as root. This gives the attacker the highest privilege level stated for the affected device.
Which firmware version is identified as affected?
The vulnerability is identified in Advantech EKI-1242IEIMS firmware version V1.06.01. The provided data does not identify other affected or fixed firmware versions.