Advantech EKI-1242IEIMS CVE-2026-19535

Exploitation requires an administrator to be actively authenticated to the LuCI administrative web interface of an Advantech EKI-1242IEIMS (firmware V1.06.01) AND to be lured into visiting attacker-controlled web content while that session is active (UI:A). The device's LuCI interface must be network-reachable to the victim's browser. Limiting factors: the attack fails against a logged-out or idle-session admin, depends on the CSRF request being accepted (no valid anti-CSRF token enforcement), and the required user-interaction/social-engineering step meaningfully constrains reliability despite the unauthenticated (PR:N) attacker prerequisite.

The vendor CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity CSRF requiring victim interaction (UI:A). The PR:N metric denotes that the ATTACKER needs no credentials, but this is materially gated: successful exploitation requires an authenticated administrator to be logged into the LuCI interface AND to visit an attacker-controlled page while that session is active - CSRF cannot be triggered against an idle or logged-out admin. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so this is no public exploit identified at time of analysis; it is a high-CVSS finding whose real-world likelihood depends heavily on the social-engineering step and admin session state rather than on autonomous, wormable exploitation. The full VC:H/VI:H/VA:H impact rating is also somewhat generous for a classic CSRF: an attacker can force state-changing admin actions (integrity/availability) but typically cannot read cross-origin responses, making the confidentiality claim weaker than rated. Net: a legitimate patch-priority issue for exposed OT/industrial deployments, but not an imminent mass-exploitation threat absent POC/KEV signals.

An attacker crafts a malicious web page (or email link) containing auto-submitting forms that target the LuCI administrative endpoints of an Advantech EKI-1242IEIMS. When a currently-logged-in administrator is lured into visiting the page, their browser silently submits forged privileged requests (e.g., altering device configuration or credentials) using the admin's active session cookie. No public exploit code is identified at time of analysis, and the attack succeeds only while the admin's session is valid.