Eki 1242Ieims
Monthly
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 can upload firmware images that the device accepts without any cryptographic signature or certificate verification, resulting in full, persistent compromise of the platform (CWE-345; CVSS 4.0 base 8.6). The risk is genuine but access-gated: the attacker must already hold administrator-level credentials for the management interface (PR:H), so this CVE does not by itself provide a pre-authentication or privilege-escalation path, but the resulting ability to replace device firmware gives durable control over an industrial edge device that may sit on an OT/IT boundary. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (reported in firmware V1.06.01) allows an attacker holding high-privilege management credentials to run arbitrary operating-system commands as root through crafted request parameters. Exploitation requires network reachability to the device's management plane plus valid privileged authentication (CVSS PR:H), after which a single low-complexity, no-interaction request yields full confidentiality, integrity, and availability impact on the appliance (assessed CVSS 3.1 base 8.8; vendor-published CVSS 4.0 score 8.6). Intelligence sources show no CISA KEV listing and no public exploit identified at time of analysis; the practical gate is that these OT edge devices are normally deployed on segmented industrial networks rather than internet-exposed, making management-plane reachability the limiting factor.
Session pool exhaustion in the OPC UA gateway of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial switches running firmware V1.06.01 lets an unauthenticated attacker on an adjacent network segment open multiple anonymous OPC UA sessions and consume the entire server session pool, causing a complete denial of service for all legitimate OPC UA clients. The impact is availability-only (no data read or modified, other device functions unaffected) and is bounded by the adjacency requirement plus the need for the OPC UA gateway to be enabled and to accept anonymous sessions, matching the reported CVSS 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) and the independently assessed CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. There is no CISA KEV listing and no public exploit identified at time of analysis; the finding is credited to Nozomi Networks Labs.
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 allows any observer positioned on the same network segment to recover sensitive device identity and network metadata as it traverses the wire. The vulnerability is unauthenticated and requires no user interaction (CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N), but our independent assessment scopes the real-world impact to confidentiality only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) because a purely passive observer cannot alter or disrupt device behavior - the CVSS 4.0 base score of 8.7 reflects the vector's asserted high integrity and availability impact, which is not supported by the exploitation conditions. No public exploit code and no CISA KEV listing were identified at time of analysis, and the primary limiting factor is the requirement for network adjacency (the protocol is not remotely routable).
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management protocol on TCP port 5058 without any authentication, allowing a remote unauthenticated attacker who can reach that port to invoke critical device-management functions such as network reconfiguration, reboot, reset, and firmware upgrade. The flaw is a CWE-306 missing authentication for critical function issue with CVSS 8.8 (v4.0) and an independently assessed CVSS 3.1 of 8.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the vector contains PR:N, confirming no credentials or user interaction are required. Impact is integrity and availability only - there is no confidentiality exposure - and there is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk is gated by whether the OT management segment is reachable from an untrusted network.
Unauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gateways running firmware V1.06.01 lets remote attackers execute arbitrary operating-system commands with root privileges via crafted requests sent to TCP port 5058. No credentials or user interaction are required (CVSS 4.0 vector PR:N/UI:N, provider score 9.3; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact), and default configurations are affected. Exploitation is gated only by network reachability to the management port - there is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the issue is a genuine high-priority risk on any deployment where port 5058 is exposed beyond a trusted management segment.
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIMS) firmware V1.06.01 allows an attacker who already holds administrative credentials on the device's web management interface to upload a crafted backup archive whose internal file names/paths are not validated, causing arbitrary files on the device filesystem to be overwritten. The result is complete loss of confidentiality, integrity and availability for the device itself (CVSS 4.0 base 8.6; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), making it a genuine but authentication-gated risk in a niche OT/industrial networking device rather than a pre-auth compromise path. Because exploitation requires both network reachability to the management plane and high-privilege authentication (PR:H), realistic exposure is driven by default, weak or reused admin credentials, internet- or flat-network-exposed management interfaces, and any credential compromise on the management VLAN; no public exploit code has been identified and there is no CISA KEV entry for this CVE at time of analysis.
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running firmware V1.06.01, because the Modbus CSV import workflow fails to neutralize code embedded in an uploaded configuration file (CWE-94). Exploitation requires an attacker to already hold a high-privilege authenticated session on the device web management interface and to be able to reach that interface over the network, which materially limits exposure in properly segmented OT environments; no user interaction on the part of a legitimate operator is needed, only the attacker's own crafted upload. Successful exploitation yields full loss of confidentiality, integrity, and availability of the device, but no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV); the vulnerability was identified by Nozomi Networks Labs and a vendor security advisory has been published.
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privilege administrative credentials send a crafted HTTP request whose unsanitized parameters are passed into an OS command executed as root, yielding full compromise of confidentiality, integrity, and availability of the device. The attack is remote and low-complexity with no user interaction required, but it is access-gated: the CVSS 4.0 vector carries PR:H, so exploitation presupposes valid admin access to the management UI - no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Risk is materially amplified when the web interface is reachable from untrusted networks and protected only by default or weak credentials, a common condition for field-deployed industrial gateways.
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industrial gateways on firmware V1.06.01 lets a remote attacker who already holds high-privilege web UI credentials execute arbitrary code on the device, including OS commands running as root. Exploitation is low-complexity once the attacker is authenticated, but the admin credential requirement (CVSS PR:H) is a hard gate that limits exposure to devices whose management interfaces are reachable and whose admin accounts have been compromised, reused, or left at weak/default values. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Advantech has published a security advisory for the issue, with Nozomi Networks Labs credited for the discovery. Risk framing: this is a genuine but access-gated risk concentrated on internet- or flat-network-exposed management interfaces rather than on segmented OT deployments.
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices running firmware V1.06.01 lets a remote attacker who already holds a valid authenticated session on the management UI execute arbitrary operating system commands with root privileges through crafted request parameters. The vulnerability (CWE-78), reported by Nozomi Networks Labs, is rated 8.6 under CVSS 4.0 (our independent assessment maps it to 8.8 under CVSS 3.1, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high PR:H value means the attacker must first authenticate - typically at administrator level - before the injection is reachable. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven less by exploit popularity than by how broadly the device's management plane is exposed to untrusted networks.
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.06.01 can execute arbitrary operating system commands as root through the device's web management interface, because crafted request parameters reach an OS command without proper neutralization (CWE-78, OS Command Injection). The vendor-assigned CVSS 4.0 score is 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), reflecting network reachability and complete compromise of the device's confidentiality, integrity and availability with no user interaction, but exploitation deliberately depends on the attacker first holding valid administrative credentials on the management UI. Reported by Nozomi Networks Labs; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the realistic risk is driven by whether the web interface is exposed and how tightly administrative access is controlled.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets a remote authenticated attacker with high privileges execute arbitrary OS commands as root. Exploitation requires a valid high-privilege session (CVSS 4.0 PR:H) and network reachability to the management interface, but then yields full device compromise (VC:H/VI:H/VA:H). No public exploit or active exploitation has been identified at time of analysis.
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01 allows a remote, unauthenticated attacker to make an authenticated administrator's browser issue unauthorized state-changing requests, reaching privileged device management functions with high integrity and availability impact (vendor CVSS 4.0 base 8.6; independent 3.1 assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Exploitation is conditional and social-engineering dependent: the administrator must hold an active LuCI session and be lured into visiting attacker-controlled content, so the technique fails against logged-out or idle-session administrators and reliability is constrained by the required user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the Modbus transaction management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privileged authenticated access to the gateway web UI persist malicious script that later executes in the browser of any administrator who opens the affected management page. Because the payload is stored and served from the device itself, the more serious consequences land in the victim administrator's browser session (scope change to High per the CVSS:4.0 vector, and C:H/I:H/S:H in the 3.1 assessment) while impact on the gateway itself is limited to Low confidentiality and integrity, with no availability impact. Exploitation requires two compounding preconditions - pre-existing admin credentials (PR:H) and a victim administrator's subsequent page view (UI:P) - so there is no unauthenticated or zero-interaction path; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 can upload firmware images that the device accepts without any cryptographic signature or certificate verification, resulting in full, persistent compromise of the platform (CWE-345; CVSS 4.0 base 8.6). The risk is genuine but access-gated: the attacker must already hold administrator-level credentials for the management interface (PR:H), so this CVE does not by itself provide a pre-authentication or privilege-escalation path, but the resulting ability to replace device firmware gives durable control over an industrial edge device that may sit on an OT/IT boundary. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (reported in firmware V1.06.01) allows an attacker holding high-privilege management credentials to run arbitrary operating-system commands as root through crafted request parameters. Exploitation requires network reachability to the device's management plane plus valid privileged authentication (CVSS PR:H), after which a single low-complexity, no-interaction request yields full confidentiality, integrity, and availability impact on the appliance (assessed CVSS 3.1 base 8.8; vendor-published CVSS 4.0 score 8.6). Intelligence sources show no CISA KEV listing and no public exploit identified at time of analysis; the practical gate is that these OT edge devices are normally deployed on segmented industrial networks rather than internet-exposed, making management-plane reachability the limiting factor.
Session pool exhaustion in the OPC UA gateway of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial switches running firmware V1.06.01 lets an unauthenticated attacker on an adjacent network segment open multiple anonymous OPC UA sessions and consume the entire server session pool, causing a complete denial of service for all legitimate OPC UA clients. The impact is availability-only (no data read or modified, other device functions unaffected) and is bounded by the adjacency requirement plus the need for the OPC UA gateway to be enabled and to accept anonymous sessions, matching the reported CVSS 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) and the independently assessed CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. There is no CISA KEV listing and no public exploit identified at time of analysis; the finding is credited to Nozomi Networks Labs.
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 allows any observer positioned on the same network segment to recover sensitive device identity and network metadata as it traverses the wire. The vulnerability is unauthenticated and requires no user interaction (CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N), but our independent assessment scopes the real-world impact to confidentiality only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) because a purely passive observer cannot alter or disrupt device behavior - the CVSS 4.0 base score of 8.7 reflects the vector's asserted high integrity and availability impact, which is not supported by the exploitation conditions. No public exploit code and no CISA KEV listing were identified at time of analysis, and the primary limiting factor is the requirement for network adjacency (the protocol is not remotely routable).
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management protocol on TCP port 5058 without any authentication, allowing a remote unauthenticated attacker who can reach that port to invoke critical device-management functions such as network reconfiguration, reboot, reset, and firmware upgrade. The flaw is a CWE-306 missing authentication for critical function issue with CVSS 8.8 (v4.0) and an independently assessed CVSS 3.1 of 8.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the vector contains PR:N, confirming no credentials or user interaction are required. Impact is integrity and availability only - there is no confidentiality exposure - and there is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk is gated by whether the OT management segment is reachable from an untrusted network.
Unauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gateways running firmware V1.06.01 lets remote attackers execute arbitrary operating-system commands with root privileges via crafted requests sent to TCP port 5058. No credentials or user interaction are required (CVSS 4.0 vector PR:N/UI:N, provider score 9.3; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact), and default configurations are affected. Exploitation is gated only by network reachability to the management port - there is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the issue is a genuine high-priority risk on any deployment where port 5058 is exposed beyond a trusted management segment.
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIMS) firmware V1.06.01 allows an attacker who already holds administrative credentials on the device's web management interface to upload a crafted backup archive whose internal file names/paths are not validated, causing arbitrary files on the device filesystem to be overwritten. The result is complete loss of confidentiality, integrity and availability for the device itself (CVSS 4.0 base 8.6; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), making it a genuine but authentication-gated risk in a niche OT/industrial networking device rather than a pre-auth compromise path. Because exploitation requires both network reachability to the management plane and high-privilege authentication (PR:H), realistic exposure is driven by default, weak or reused admin credentials, internet- or flat-network-exposed management interfaces, and any credential compromise on the management VLAN; no public exploit code has been identified and there is no CISA KEV entry for this CVE at time of analysis.
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running firmware V1.06.01, because the Modbus CSV import workflow fails to neutralize code embedded in an uploaded configuration file (CWE-94). Exploitation requires an attacker to already hold a high-privilege authenticated session on the device web management interface and to be able to reach that interface over the network, which materially limits exposure in properly segmented OT environments; no user interaction on the part of a legitimate operator is needed, only the attacker's own crafted upload. Successful exploitation yields full loss of confidentiality, integrity, and availability of the device, but no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV); the vulnerability was identified by Nozomi Networks Labs and a vendor security advisory has been published.
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privilege administrative credentials send a crafted HTTP request whose unsanitized parameters are passed into an OS command executed as root, yielding full compromise of confidentiality, integrity, and availability of the device. The attack is remote and low-complexity with no user interaction required, but it is access-gated: the CVSS 4.0 vector carries PR:H, so exploitation presupposes valid admin access to the management UI - no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Risk is materially amplified when the web interface is reachable from untrusted networks and protected only by default or weak credentials, a common condition for field-deployed industrial gateways.
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industrial gateways on firmware V1.06.01 lets a remote attacker who already holds high-privilege web UI credentials execute arbitrary code on the device, including OS commands running as root. Exploitation is low-complexity once the attacker is authenticated, but the admin credential requirement (CVSS PR:H) is a hard gate that limits exposure to devices whose management interfaces are reachable and whose admin accounts have been compromised, reused, or left at weak/default values. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Advantech has published a security advisory for the issue, with Nozomi Networks Labs credited for the discovery. Risk framing: this is a genuine but access-gated risk concentrated on internet- or flat-network-exposed management interfaces rather than on segmented OT deployments.
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices running firmware V1.06.01 lets a remote attacker who already holds a valid authenticated session on the management UI execute arbitrary operating system commands with root privileges through crafted request parameters. The vulnerability (CWE-78), reported by Nozomi Networks Labs, is rated 8.6 under CVSS 4.0 (our independent assessment maps it to 8.8 under CVSS 3.1, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high PR:H value means the attacker must first authenticate - typically at administrator level - before the injection is reachable. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven less by exploit popularity than by how broadly the device's management plane is exposed to untrusted networks.
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.06.01 can execute arbitrary operating system commands as root through the device's web management interface, because crafted request parameters reach an OS command without proper neutralization (CWE-78, OS Command Injection). The vendor-assigned CVSS 4.0 score is 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), reflecting network reachability and complete compromise of the device's confidentiality, integrity and availability with no user interaction, but exploitation deliberately depends on the attacker first holding valid administrative credentials on the management UI. Reported by Nozomi Networks Labs; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the realistic risk is driven by whether the web interface is exposed and how tightly administrative access is controlled.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets a remote authenticated attacker with high privileges execute arbitrary OS commands as root. Exploitation requires a valid high-privilege session (CVSS 4.0 PR:H) and network reachability to the management interface, but then yields full device compromise (VC:H/VI:H/VA:H). No public exploit or active exploitation has been identified at time of analysis.
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01 allows a remote, unauthenticated attacker to make an authenticated administrator's browser issue unauthorized state-changing requests, reaching privileged device management functions with high integrity and availability impact (vendor CVSS 4.0 base 8.6; independent 3.1 assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Exploitation is conditional and social-engineering dependent: the administrator must hold an active LuCI session and be lured into visiting attacker-controlled content, so the technique fails against logged-out or idle-session administrators and reliability is constrained by the required user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the Modbus transaction management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privileged authenticated access to the gateway web UI persist malicious script that later executes in the browser of any administrator who opens the affected management page. Because the payload is stored and served from the device itself, the more serious consequences land in the victim administrator's browser session (scope change to High per the CVSS:4.0 vector, and C:H/I:H/S:H in the 3.1 assessment) while impact on the gateway itself is limited to Low confidentiality and integrity, with no availability impact. Exploitation requires two compounding preconditions - pre-existing admin credentials (PR:H) and a victim administrator's subsequent page view (UI:P) - so there is no unauthenticated or zero-interaction path; no public exploit code or confirmed active exploitation was identified at time of analysis.