CVE-2026-73167

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary OS commands as root via crafted request parameters.

  • Published Sep 16, 2026
  • CVSS 8.6 high
  • 1.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-73167 at the National Vulnerability Database