Advantech EKI-1242EIMS vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Advantech EKI-1242EIMS: 15 record(s), with affected versions and fixes.
CVE-2026-73177
High · 8.6
CWE-345 Sep 16, 2026
Insufficient Verification of Data Authenticity in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.
CVE-2026-73176
High · 8.6
CWE-78 Sep 16, 2026
OS Command Injection in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-73175
High · 7.1
CWE-400 Sep 16, 2026
Uncontrolled Resource Consumption in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server session pool and cause a complete denial of service to all legitimate OPC UA clients by opening multiple anonymous sessions.
CVE-2026-73174
High · 8.7
CWE-319 Sep 16, 2026
Cleartext Transmission of Sensitive Information in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata in cleartext.
CVE-2026-73173
High · 8.8
CWE-306 Sep 16, 2026
Missing Authentication for Critical Function in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.
CVE-2026-73172
Critical · 9.3
CWE-78 Sep 16, 2026
OS Command Injection in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to execute arbitrary OS commands as root via crafted requests to TCP port 5058.
CVE-2026-73171
High · 8.6
CWE-73 Sep 16, 2026
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path…
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.
CVE-2026-73170
High · 8.6
CWE-94 Sep 16, 2026
Code Injection in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a crafted imported file.
CVE-2026-73169
Medium · 6.3
CWE-79 Sep 16, 2026
Cross-site Scripting (XSS) in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store malicious script content that executes in the browser of any administrator who later opens an affected management page.
CVE-2026-73167
High · 8.6
CWE-78 Sep 16, 2026
OS Command Injection in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-73166
High · 8.6
CWE-94 Sep 16, 2026
Code Injection in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary code on the device, including OS commands as root.
CVE-2026-73165
High · 8.6
CWE-78 Sep 16, 2026
OS Command Injection in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-73164
High · 8.6
CWE-78 Sep 16, 2026
OS Command Injection in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-73163
High · 8.6
CWE-78 Sep 16, 2026
OS Command Injection in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-19535
High · 8.6
CWE-352 Sep 16, 2026
Cross-Site Request Forgery (CSRF) in Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to perform unauthorized state-changing requests on behalf of a logged-in administrator, enabling unauthorized access to privileged management functions.