CVE-2026-73167: OS Command Injection
Published Sep 16, 2026
·Updated
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
Affected Software
1 affected component
Advantech EKI-1242IEIMS=V1.06.01
Event History
Sep 16, 2026
CVE Published
via MITRE·12:51 PM
Data Sourced
via MITRE·12:51 PM
DescriptionWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
An attacker must be able to reach the device's web management interface and authenticate. Exploitation is performed by sending crafted request parameters after authentication.
2
What level of access could successful exploitation provide?
Successful exploitation allows arbitrary operating-system commands to be executed as root on the affected device.
3
Which firmware version is identified as affected?
The vulnerability is identified in Advantech EKI-1242IEIMS firmware version V1.06.01.