Advantech EKI-1242IEIMS CVE-2026-73163

Exploitation requires an authenticated session at high privilege (PR:H) on the web management interface of an Advantech EKI-1242IEIMS running firmware V1.06.01; the attacker then supplies crafted request parameters that are improperly neutralized and executed as OS commands running as root. Limiting factors: valid privileged web-admin credentials are mandatory (no unauthenticated path), the device's management interface must be network-reachable to the attacker, and the specific vulnerable firmware version must be deployed - in typical OT deployments these gateways sit on segmented industrial networks, further constraining reachability.

The CVSS 4.0 base score of 8.6 (High) is driven by full compromise potential (VC:H/VI:H/VA:H) via network vector with low complexity, but is meaningfully gated by PR:H - the attacker must already hold high-privilege authenticated access to the web management interface before injecting OS commands that run as root. This is a credentialed post-authentication flaw, not a pre-auth remote takeover, so it functions more as a privilege-escalation / persistence primitive (turning admin web access into root shell on the device) than as a mass-exploitable internet threat. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, and the reporting party is Nozomi Networks Labs (an OT security research firm) rather than an in-the-wild detection - collectively indicating no evidence of active exploitation. The residual risk is highest in OT/ICS environments where these gateways are reachable and where web-admin credentials are weak, shared, or default. Note the input CVSS is 4.0 only; no 3.1 vector was supplied, so cross-framework comparison relies on the assessed 3.1 vector below.

An attacker who has obtained (or guessed/reused) high-privilege credentials for the EKI-1242IEIMS web management interface sends a crafted request whose parameters are passed unsanitized into an OS command, executing arbitrary commands as root on the gateway. No public exploit code was identified in the provided data; exploitation requires prior authentication at a privileged level (PR:H).