Which versions of Advantech EKI-1242IEIMS are affected by CVE-2026-73164?

Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.06.01 contain an OS command injection flaw that lets anyone holding valid administrative credentials on the device's…

How to fix or mitigate CVE-2026-73164?

Within 24 hours, inventory all Advantech EKI-1242IEIMS and EKI-1242EIMS units and confirm which are running firmware V1.06.01, then determine whether each device's web management interface is reachable from untrusted networks, the internet, or broad internal segments; where it is, immediately restrict access to a hardened management VLAN or jump host allowlist and disable any WAN-facing management exposure. Also in the first 24 hours, force a credential reset on all administrative accounts for these gateways, eliminate shared or default admin logins, and enable logging of management UI authentication and configuration activity to a monitored collector. Within 7 days, stand up compensating network controls around the affected devices (deny-by-default firewall rules, segmentation between the gateway management plane and both IT and OT networks, and rate/anomaly alerting on the web interface) and open a support case with Advantech to confirm whether an interim firmware build or configuration-level hardening guidance exists for V1.06.01, since no vendor-released patch has been identified at time of analysis. Within 30 days, complete a risk-ranked remediation plan that replaces or upgrades affected units to a fixed firmware release as soon as Advantech publishes one, re-validates that administrative access is limited to a named, least-privilege account set with MFA where the platform supports it, and folds these devices into routine OT patch and asset management cadence with quarterly verification of firmware versions.

Advantech EKI-1242IEIMS CVE-2026-73164

Q: What is the CVSS score of CVE-2026-73164?

CVE-2026-73164 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-80735 HIGH

OS Command Injection (CWE-78)

2026-09-16 Nozomi

Command Injection Advantech Eki 1242Ieims Eki 1242Eims

8.6

CVSS 4.0 · Vendor: Nozomi

Severity by source

Vendor (Nozomi) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable web interface (AV:N/AC:L) but requires authenticated high-privilege admin access (PR:H); command injection yields full root control, so C/I/A all High, scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Nozomi).

CVSS VectorVendor: Nozomi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 13:19 vuln.today

CVE Published

Sep 16, 2026 - 12:37 cve.org

HIGH 8.6

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.

AnalysisAI

Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.06.01 can execute arbitrary operating system commands as root through the device's web management interface, because crafted request parameters reach an OS command without proper neutralization (CWE-78, OS Command Injection). The vendor-assigned CVSS 4.0 score is 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), reflecting network reachability and complete compromise of the device's confidentiality, integrity and availability with no user interaction, but exploitation deliberately depends on the attacker first holding valid administrative credentials on the management UI. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated session with high privileges (PR:H) on the web management interface of an Advantech EKI-1242IEIMS or EKI-1242EIMS gateway running firmware V1.06.01; the attacker then sends crafted request parameters that are injected into an OS command executed as root. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine root-level OS command injection (CWE-78) in the web management interface of the Advantech EKI-1242IEIMS/EKI-1242EIMS industrial gateway, carrying a vendor CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Advantech has issued a security advisory for this issue (https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf), and the finding is documented by Nozomi Networks Labs at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73164; because the available data does not specify an exact fixed firmware version, the primary action is to obtain the vendor's remediated firmware build from Advantech support, apply it to every EKI-1242IEIMS/EKI-1242EIMS unit, and verify the installed version afterwards. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Advantech EKI-1242IEIMS and EKI-1242EIMS units and confirm which are running firmware V1.06.01, then determine whether each device's web management interface is reachable from untrusted networks, the internet, or broad internal segments; where it is, immediately restrict access to a hardened management VLAN or jump host allowlist and disable any WAN-facing management exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.