RCE in Advantech Eki-1242eims
CVE-2026-73172
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to execute arbitrary OS commands as root via crafted requests to TCP port 5058.
Vulnerability class: Command Injection (OS Command Injection)
Affected products
Weakness classification (CWE)
References
- prodsec@nozominetworks.com (vendor-advisory)
- prodsec@nozominetworks.com (third-party-advisory)