Advantech EKI-1242IEIMS EUVD-2026-80735

Exploitation requires an authenticated session with high privileges (PR:H) on the web management interface of an Advantech EKI-1242IEIMS or EKI-1242EIMS gateway running firmware V1.06.01; the attacker then sends crafted request parameters that are injected into an OS command executed as root. Network reachability to the management interface is required (AV:N, no user interaction). The principal limiting factors are the need for valid administrative credentials and network exposure of the management interface - devices with the web UI segmented to an isolated OT/management VLAN and with strong, non-default admin credentials substantially reduce exploitability.

This is a genuine root-level OS command injection (CWE-78) in the web management interface of the Advantech EKI-1242IEIMS/EKI-1242EIMS industrial gateway, carrying a vendor CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H). The vector is well-calibrated: network-reachable and low-complexity, but gated behind PR:H (high privileges), meaning the attacker must already be an authenticated administrative user of the web interface - this is the single most important limiting factor and drops the score meaningfully below the ~9.8 an unauthenticated equivalent would earn. Impact once triggered is maximal (full confidentiality/integrity/availability as root). No EPSS score, no CISA KEV listing, and no public POC are provided, so this is 'no public exploit identified at time of analysis' - the finding originates from Nozomi Networks Labs coordinated research with a corresponding Advantech advisory, indicating responsible disclosure rather than in-the-wild abuse. Net assessment: technically severe (root RCE) but real-world urgency is moderated by the authentication requirement, the niche industrial-device footprint, and the absence of any exploitation or POC signal. Prioritize for OT environments where the device is exposed, but this is not a mass-exploitation internet emergency.

An attacker who has obtained valid administrative credentials to the EKI-1242IEIMS web management interface (via default/weak creds, credential reuse, or network foothold) sends a crafted HTTP request with malicious parameters that are passed unsanitized into an OS command. The injected command executes as root, giving full control of the gateway. No public POC is currently identified, but the flaw is documented by Nozomi Networks Labs and Advantech.