Vulnerabilidades do Advantech EKI-1242IEIMS
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Advantech EKI-1242IEIMS: 15 registro(s), com versões afetadas e correções.
CVE-2026-73177
Alta · 8.6
CWE-345 16/09/2026
Insufficient Verification of Data Authenticity em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.
CVE-2026-73176
Alta · 8.6
CWE-78 16/09/2026
OS Command Injection em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-73175
Alta · 7.1
CWE-400 16/09/2026
Uncontrolled Resource Consumption em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server session pool and cause a complete denial of service to all legitimate OPC UA clients by opening multiple anonymous sessions.
CVE-2026-73174
Alta · 8.7
CWE-319 16/09/2026
Cleartext Transmission of Sensitive Information em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata in cleartext.
CVE-2026-73173
Alta · 8.8
CWE-306 16/09/2026
Missing Authentication for Critical Function em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.
CVE-2026-73172
Crítica · 9.3
CWE-78 16/09/2026
OS Command Injection em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to execute arbitrary OS commands as root via crafted requests to TCP port 5058.
CVE-2026-73171
Alta · 8.6
CWE-73 16/09/2026
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path…
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.
CVE-2026-73170
Alta · 8.6
CWE-94 16/09/2026
Code Injection em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a crafted imported file.
CVE-2026-73169
Média · 6.3
CWE-79 16/09/2026
Cross-site Scripting (XSS) em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store malicious script content that executes in the browser of any administrator who later opens an affected management page.
CVE-2026-73167
Alta · 8.6
CWE-78 16/09/2026
OS Command Injection em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-73166
Alta · 8.6
CWE-94 16/09/2026
Code Injection em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary code on the device, including OS commands as root.
CVE-2026-73165
Alta · 8.6
CWE-78 16/09/2026
OS Command Injection em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-73164
Alta · 8.6
CWE-78 16/09/2026
OS Command Injection em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-73163
Alta · 8.6
CWE-78 16/09/2026
OS Command Injection em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.
CVE-2026-19535
Alta · 8.6
CWE-352 16/09/2026
Cross-Site Request Forgery (CSRF) em Advantech EKI-1242IEIMS
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to perform unauthorized state-changing requests on behalf of a logged-in administrator, enabling unauthorized access to privileged management functions.