CVE-2026-73165: OS Command Injection
Published Sep 16, 2026
·Updated
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
Affected Software
1 affected component
Advantech EKI-1242IEIMS=V1.06.01
Event History
Sep 16, 2026
CVE Published
via MITRE·12:44 PM
Data Sourced
via MITRE·12:44 PM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be remote and authenticated to the device's web management interface. Successful exploitation allows arbitrary OS commands to run as root.
2
Which firmware version is identified as affected?
The reported affected firmware version is V1.06.01 for the Advantech EKI-1242IEIMS.