# CVE-2026-19535: Advantech EKI-1242 CSRF in LuCI administrative interface

Source: https://junglewise.ai/threats/cve-2026-19535-advantech-eki-1242-csrf-in-luci-administrative-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19535 · Severity: info · CVSS 8.6 · Published 2026-09-16

The Advantech EKI-1242 industrial network switch contains a cross-site request forgery vulnerability in its web-based management interface. An attacker can trick a logged-in administrator into unknowingly performing privileged actions such as changing network settings or disabling security features, compromising the integrity and availability of critical infrastructure networks.

Technologies: [Advantech EKI-1242EIMS](https://junglewise.ai/threats/technologies/eki-1242eims), [Advantech EKI-1242IEIMS](https://junglewise.ai/threats/technologies/eki-1242ieims). Vendors: [Advantech](https://junglewise.ai/threats/vendors/advantech).

## Quick answers

**Is CVE-2026-19535 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19535 being exploited in the wild.

**How severe is CVE-2026-19535?** Informational severity, with a CVSS score of 8.6, published 16 September 2026.

**Which products and versions are affected?** Advantech EKI-1242EIMS V1.06.01; Advantech EKI-1242IEIMS V1.06.01.

**Is there a fix for CVE-2026-19535?** A patch was published on 2026-09-04: Firmware version 2.00.01 resolves the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19535 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-19535?** Check whether you run Advantech EKI-1242EIMS or Advantech EKI-1242IEIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-site request forgery (CWE-352) vulnerability exists in the LuCI administrative web interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS switches running firmware version V1.06.01. An unauthenticated remote attacker can craft a malicious web page that, when visited by a logged-in administrator, triggers unauthorized state-changing requests (such as configuration modifications) without the administrator's knowledge or consent. No special privileges or user interaction beyond browsing a malicious site is required for the attack. The vulnerability is resolved in firmware version 2.00.01.

## Affected products

- Advantech EKI-1242IEIMS V1.06.01
- Advantech EKI-1242EIMS V1.06.01

## Timeline

- 2026-09-16: disclosed
- 2026-09-04: patched: Firmware version 2.00.01 resolves the vulnerability

## References

- [https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf](https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf)
- [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-19535](https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-19535)

## Related threats

- [Advantech EKI-1242EIMS firmware signature verification bypass](https://junglewise.ai/threats/cve-2026-73177-advantech-eki-1242eims-firmware-signature-verification-bypass)
- [Advantech EKI-1242IEIMS OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-73176-advantech-eki-1242ieims-os-command-injection-in-web-management)
- [Advantech EKI-1242 denial of service in OPC UA gateway](https://junglewise.ai/threats/cve-2026-73175-advantech-eki-1242-denial-of-service-in-opc-ua-gateway)
- [Advantech EKI-1242 cleartext transmission of sensitive information](https://junglewise.ai/threats/cve-2026-73174-advantech-eki-1242-cleartext-transmission-of-sensitive)
- [Advantech EKI-1242IEIMS missing authentication in management protocol](https://junglewise.ai/threats/cve-2026-73173-advantech-eki-1242ieims-missing-authentication-in-management)