EUVD-2026-80734
GHSA-4mc4-2f89-r5fj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated management access
-
DeliveryCraft malicious request parameters
-
ExploitInject OS command into web interface
-
ExecutionCommand executes as root
-
ImpactFull device takeover and OT pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the web management interface of an Advantech EKI-1242IEIMS (or EKI-1242EIMS) running firmware V1.06.01, AND a valid authenticated session on that interface (vendor rates this PR:H / administrator-level). Given valid credentials, exploitation is low-complexity with no user interaction. Limiting factors: the attacker must first authenticate, and the management interface should not be exposed to untrusted networks - proper OT network segmentation and restriction of the management plane substantially reduce realistic exposure. No non-default feature toggle is required beyond the management interface being reachable. |
| Impact | This is a genuine but privilege-gated priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, score 8.6) describes a remotely reachable, low-complexity OS command injection yielding full compromise (code execution as root) - the maximal technical impact. The single most important mitigating signal is PR:H: exploitation requires an already-authenticated session against the web management interface, so this is not a pre-auth internet-wide worm candidate but rather a privilege-escalation/lateral-movement primitive for an attacker who already has (or can phish/brute/default-credential their way to) management access. No CISA KEV listing, no public exploit code cited, and no EPSS score are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is currently theoretical-but-credible given a named finder (Nozomi Networks Labs) and a confirming vendor advisory. Note a metric tension worth verifying: the description says only 'remote authenticated attacker' without specifying privilege tier, yet the vendor assigned PR:H (administrator-level) - if any authenticated low-privilege account can trigger it, the true privilege bar is PR:L and real-world risk is higher than the vector implies. |
| Exploit ScenarioDerived | An attacker who has obtained credentials to the EKI-1242IEIMS web management interface (via default/weak credentials, credential reuse, or prior network foothold) submits a crafted request whose parameters are passed unsanitized into an OS command, executing arbitrary commands as root on the industrial Ethernet gateway. This yields full device takeover, enabling manipulation of OT traffic, persistence, or pivoting deeper into the control network. No public proof-of-concept exploit is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices running firmware V1.06.01 lets a remote attacker who already holds a valid authenticated session on the management UI execute arbitrary operating system commands with root privileges through crafted request parameters. The vulnerability (CWE-78), reported by Nozomi Networks Labs, is rated 8.6 under CVSS 4.0 (our independent assessment maps it to 8.8 under CVSS 3.1, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high PR:H value means the attacker must first authenticate - typically at administrator level - before the injection is reachable. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven less by exploit popularity than by how broadly the device's management plane is exposed to untrusted networks.
RemediationAI
No exact fixed firmware version is confirmed in the available data and no vendor-released patch identifier is present in the provided references, so the first action is to retrieve the Advantech security advisory (https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf) and apply the vendor-designated firmware update for the EKI-1242IEIMS and EKI-1242EIMS as soon as it is confirmed; also monitor the Nozomi Networks Labs advisory (https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73165) for any revision. Until a fix is applied, the strongest compensating control is to remove the management interface from any untrusted network: place the web UI on a dedicated administrative VLAN reachable only through a hardened jump host or VPN, and block inbound HTTP/HTTPS to the device from WAN, internet, and general corporate subnets with firewall rules at the OT boundary - the trade-off is loss of direct remote administration, which must be replaced by the out-of-band path. Disable management access from any non-administrative source and keep the number of accounts holding admin rights on the device to a minimum, since a valid privileged session is a hard prerequisite for exploitation; rotate those credentials and review device logs for anomalous requests containing shell metacharacters. Where the web UI cannot be isolated, restrict access by source-IP allowlist and monitor the management listener for command-injection patterns - this reduces but does not eliminate exposure, because the injection occurs post-authentication and a compromised or reused admin credential would still reach it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-78 OS command injection in the embedded web management interface of the Advantech EKI-1242 series. In this class of defect, a request parameter supplied by the user is concatenated into a shell command string and passed to the operating system without neutralization of shell metacharacters, so a crafted value breaks out of the intended command context and appends attacker-chosen commands. Because the web management service on these industrial devices runs with elevated privileges, successful injection yields commands executed as root, giving full control of the device's underlying OS rather than merely its management application. The vendor CPE strings (cpe:2.3:a:advantech:eki-1242ieims:* and cpe:2.3:a:advantech:eki-1242eims:*) use a wildcard version component, indicating the advisory's scope is the product family as tracked by the vendor, with firmware V1.06.01 explicitly named as affected in the description. Attack surface is the HTTP/HTTPS management listener; the CVSS 4.0 vector AV:N/PR:H/UI:N confirms network reachability with high-privilege authentication and no user interaction, and the assessed 3.1 vector agrees on scope-unchanged (S:U) with high confidentiality, integrity, and availability impact on the device itself, not on downstream systems. Devices of this type commonly sit at the edge of OT/ICS networks, so root compromise of the appliance can serve as a pivot point into segmented operational environments.
Know when Eki 1242Ieims gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable web interface (AV:N/AC:L), requires authentication with vendor-stated admin privilege (PR:H), no scope change, and code execution as root gives full C/I/A impact.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
DescriptionCVE.org
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
Executive ViewAI
Advantech's EKI-1242IEIMS and EKI-1242EIMS industrial edge devices running firmware V1.06.01 contain an OS command injection flaw that allows an attacker with a valid management-interface login to run arbitrary commands as root on the device. Because these units sit at the boundary of operational technology networks, a compromise could give an adversary persistent root-level control over an industrial gateway and a foothold into the environments it bridges. Leadership should care because there is currently no vendor patch, remediation depends on network exposure and administrative discipline rather than a fix, and the affected hardware is unlikely to be inventoried or monitored like traditional IT assets.
No vendor-released patch identified at time of analysis. Interim mitigations: isolate the web management interface from untrusted networks and restrict it to a dedicated administrative VLAN or local console access only; enforce firewall allow-listing of administrative source IPs and block external exposure of the management UI; restrict and audit administrative accounts, eliminate shared credentials, and rotate them; conduct authenticated session hygiene reviews and terminate idle or unexpected sessions; enable and centrally collect device logs to detect anomalous management activity; and pursue a remediation timeline and any interim guidance directly from Advantech.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Eki 1242Ieims
View allUnauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gat
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industria
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01)
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industr
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIM
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI
Exploit-DB