Advantech EKI-1242IEIMS CVE-2026-73166

Requires the attacker to be a remote AUTHENTICATED user with HIGH privileges (PR:H) on the web management interface of an Advantech EKI-1242IEIMS or EKI-1242EIMS gateway running firmware V1.06.01 - i.e., valid administrative credentials to the web UI are a hard prerequisite. Given valid admin access, exploitation is low-complexity (AC:L) with no user interaction (UI:N) and no special attack requirements (AT:N). Limiting factors: the device's web management interface must be network-reachable from the attacker, and the admin authentication gate must be passed (via legitimate, default, weak, or previously stolen credentials). Real-world exposure is reduced where these gateways sit behind OT network segmentation and use strong, unique admin passwords.

This is a genuine but access-gated risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity code-injection flaw yielding full triad impact (root-level code execution) - but PR:H is the decisive limiter: the attacker must already hold high (administrative) privileges on the web management interface. This is not a pre-auth internet-wormable bug; it is a privilege-escalation-to-root primitive for an already-authenticated admin, or a bug reachable via chained credential theft or default/weak admin credentials common on OT gear. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - treat exploitation status as 'no public exploit identified at time of analysis.' Signals are mutually consistent: high technical impact tempered by a real authentication precondition. The 8.6 rating is well-calibrated. Practical priority is moderate: high where these gateways are exposed to reachable networks with shared/default admin credentials, lower in properly segmented OT environments. The vulnerability was research-reported by Nozomi Networks Labs (not observed in the wild), reinforcing a targeted/theoretical rather than mass-exploitation posture.

An attacker who has obtained admin credentials to the EKI-1242IEIMS web management interface - via default/weak passwords, credential reuse, or a prior foothold on the OT network - submits crafted input to a vulnerable web endpoint that improperly incorporates it into generated/executed code. The injected payload runs OS commands as root, giving full control of the industrial gateway. No public exploit code is identified at time of analysis; the flaw was reported by Nozomi Networks Labs.