Advantech EKI-1242EIMS EUVD-2026-80728

Exploitation requires network reachability to the edgserver management service listening on TCP port 5058 of an Advantech EKI-1242EIMS/EKI-1242IEIMS gateway running firmware V1.06.01. No authentication, credentials, or user interaction are needed (PR:N/UI:N) and default configurations are affected. The principal limiting factor is exposure of the management port: on a properly segmented OT network this port should not be reachable from untrusted networks, so isolating/firewalling TCP 5058 to trusted management hosts is the key mitigation until patched firmware is applied.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes the worst realistic profile for a device flaw: network-reachable, low complexity, no authentication, no user interaction, and full compromise of confidentiality, integrity, and availability - the description confirms arbitrary OS command execution as root. The 9.3 score is well-calibrated to a genuine pre-auth RCE. Mitigating the raw severity: no EPSS score, no CISA KEV listing, and no public PoC are present in the supplied data, so there is currently no evidence of active or automated exploitation - the risk is high potential rather than confirmed in-the-wild abuse. The dominant real-world limiter is exposure: this is a niche OT/industrial gateway and TCP port 5058 is a non-standard management port, so exploitability depends on whether the device management interface is network-reachable to the attacker (typically it should sit on an isolated OT segment). No key signals conflict; the CVSS vector, CWE-78, and description are mutually consistent. This is the most severe of the EKI-1242 advisory cluster because it is pre-auth (PR:N), unlike its PR:H authenticated siblings.

An attacker with network reachability to an EKI-1242EIMS/IEIMS gateway sends a crafted request to the edgserver management service on TCP port 5058, injecting shell metacharacters into an unsanitized parameter. Because the service runs as root and requires no authentication, the injected OS commands execute with full root privileges, giving the attacker complete control of the gateway. No public exploit code is identified at time of analysis, but exploitation is technically simple given the AC:L/PR:N/UI:N profile.