Quick answers
- Is CVE-2026-73165 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73165 being exploited in the wild.
- How severe is CVE-2026-73165?
- Informational severity, with a CVSS score of 8.6, published 16 September 2026.
- Which products and versions are affected?
- Advantech EKI-1242EIMS V1.06.01; Advantech EKI-1242IEIMS V1.06.01.
- Is there a fix for CVE-2026-73165?
- A patch was published on 2026-09-16: Firmware version 2.00.01 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73165 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-73165?
- Check whether you run Advantech EKI-1242EIMS or Advantech EKI-1242IEIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an OS command injection vulnerability (CWE-78) in the web management interface that fails to properly sanitize or neutralize special characters in request parameters. An attacker with high-level authentication privileges can craft malicious request parameters to inject arbitrary OS commands, which are then executed by the system with root privileges. The vulnerability requires network access to the management interface and high-level user privileges (PR:H), but once authenticated, allows full command execution. Advantech released firmware version 2.00.01 as a patched version addressing this issue.
Affected products
- Advantech EKI-1242IEIMS V1.06.01
- Advantech EKI-1242EIMS V1.06.01
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Firmware version 2.00.01 available