Advantech EKI Series: 15 Vulnerabilities Including Command Injection Disclosed Together
Advantech EKI-1242EIMS/IEIMS industrial edge computers suffer from 15 vulnerabilities, including critical OS command injection and code execution flaws, patched in V1.06.01.
Key findings
- Fifteen vulnerabilities disclosed in Advantech EKI-1242EIMS/IEIMS on Sept 16, 2026.
- Flaws include critical OS command injection, code injection, and authentication bypasses.
- All vulnerabilities patched in firmware version V1.06.01.
- Nozomi Networks Labs identified the vulnerabilities.
- Impacts include remote code execution and denial of service.
On September 16, 2026, Nozomi Networks Labs disclosed a batch of fifteen vulnerabilities affecting Advantech's EKI-1242EIMS and EKI-1242IEIMS industrial edge computers. The vulnerabilities, all patched in firmware version V1.06.01, span a range of critical and high-severity flaws, including OS command injection, code injection, and authentication bypasses. This coordinated disclosure highlights significant security weaknesses in the management interfaces of these industrial devices, potentially exposing critical infrastructure to remote attacks.
Several vulnerabilities revolve around OS Command Injection (CWE-78), allowing remote authenticated attackers to execute arbitrary OS commands as root. These include CVE-2026-73176, CVE-2026-73167, CVE-2026-73165, and CVE-2026-73164, all affecting the web management interface of the EKI-1242IEIMS. Additionally, CVE-2026-73172, a critical vulnerability in the edgserver management service of the EKI-1242EIMS, also permits unauthenticated remote attackers to execute arbitrary OS commands as root.
Code injection vulnerabilities were also prominent. CVE-2026-73170, a high-severity flaw in the Modbus CSV import workflow of the EKI-1242EIMS, allows authenticated attackers to execute arbitrary Lua code. Similarly, CVE-2026-73166, a high-severity issue in the web management interface of the EKI-1242IEIMS, enables authenticated attackers to execute arbitrary code, including OS commands as root.
Other critical findings include a firmware upgrade mechanism vulnerability (CVE-2026-73177) where the device accepts firmware images without cryptographic verification, potentially allowing for the installation of malicious firmware. A denial-of-service vulnerability (CVE-2026-73175) in the OPC UA gateway component of the EKI-1242EIMS can exhaust the server session pool, rendering the device inoperable. Furthermore, cleartext transmission of sensitive information (CVE-2026-73174) in the edgserver management protocol allows passive observers to intercept management traffic.
The batch also includes a missing authentication flaw (CVE-2026-73173) in the edgserver management protocol, enabling unauthenticated remote attackers to invoke critical device-management functions. A file overwrite vulnerability (CVE-2026-73171) in the backup-restore workflow allows authenticated attackers to replace arbitrary files. A cross-site scripting (XSS) vulnerability (CVE-2026-73169) affects the Modbus transaction management interface, and a cross-site request forgery (CSRF) vulnerability (CVE-2026-19535) impacts the LuCI administrative web interface, allowing unauthorized actions on behalf of logged-in administrators.
All fifteen vulnerabilities were addressed by Advantech in firmware version V1.06.01 for both the EKI-1242EIMS and EKI-1242IEIMS models. Users of these industrial edge devices are strongly advised to update to the patched firmware immediately to mitigate the risk of remote compromise and ensure the security and operational integrity of their industrial control systems. The coordinated disclosure by Nozomi Networks Labs underscores the importance of continuous security monitoring and timely patching in the industrial IoT landscape.