Advantech EKI-1242IEIMS EUVD-2026-80732

Exploitation requires the attacker to already possess high-privilege (administrative) authenticated access to the web management interface of the Advantech EKI-1242IEIMS/EKI-1242EIMS gateway running firmware V1.06.01 (PR:H). Given that, the attack is remote and network-based (AV:N) with low complexity (AC:L) and no user interaction (UI:N): a crafted HTTP request with unsanitized parameters is injected into an OS command executed as root. The primary limiting factor is the admin authentication requirement - this is not exploitable pre-authentication or against a default-locked-down device without valid management credentials; exposure is amplified where the web interface is network-reachable and protected by default/weak credentials.

This is a genuine but access-gated vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity flaw yielding full confidentiality/integrity/availability compromise as root, but PR:H is the decisive limiter: the attacker must already hold high (administrative) privileges on the device web management interface. The vendor score of 8.6 (HIGH) is well-calibrated - the full impact triad keeps it high, while PR:H prevents a 9.x/critical rating. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation is theoretical at time of analysis rather than demonstrated. The realistic risk is therefore that of a privilege-escalation-to-root-code-execution primitive available to an already-authenticated admin, or an attacker who has bootstrapped admin credentials (default/weak passwords, credential reuse, prior compromise) - a meaningful post-authentication foothold on OT infrastructure, but not a mass-exploitable pre-auth internet threat. One data caveat: the Description names only EKI-1242IEIMS, whereas the CPE list and Tags also include EKI-1242EIMS - treat both models as affected per the CPE/advisory, but note the Description omission.

An attacker who has obtained administrative access to the Advantech EKI-1242IEIMS/EKI-1242EIMS web management interface (via default, weak, reused, or phished credentials) submits a crafted HTTP request whose parameters are passed unsanitized into an OS command, injecting shell metacharacters to run arbitrary commands as root. This grants full control of the industrial Modbus/EtherNet-IP gateway - traffic manipulation, persistence, and pivoting into the OT network. No public exploit code was identified at time of analysis, so an attacker would need to develop the injection payload from the advisory.