Advantech EKI-1242IEIMS Web Management Interface Evaluates Code from Request Parameters, Giving Authenticated Administrators Root-Level Code Execution

Last refreshed2026-09-29

Status: NEW | Advisory ID: CVE-2026-73166

Key Details

CVE	CVE-2026-73166
CVSS Score / Version	8.6 (High) / CVSS v4.0
Updated	2026-09-23
Classified as	CWE-94 (Improper Control of Generation of Code ('Code Injection'))

What to Know

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary code on the device, including OS commands as root.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-73166
CVE	https://www.cve.org/CVERecord?id=CVE-2026-73166

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-73166

CVE

https://www.cve.org/CVERecord?id=CVE-2026-73166

Advantech EKI-1242IEIMS Web Management Interface Evaluates Code from Request Parameters, Giving Authenticated Administrators Root-Level Code Execution

Key Details

What to Know

References

About