# CVE-2026-73166: Advantech EKI-1242IEIMS code injection in web management interface

Source: https://junglewise.ai/threats/cve-2026-73166-advantech-eki-1242ieims-code-injection-in-web-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73166 · Severity: info · CVSS 8.6 · Published 2026-09-16

Advantech's EKI-1242IEIMS is an industrial network management device used to monitor and control critical infrastructure. A code injection vulnerability in its web management interface allows authenticated attackers to execute arbitrary commands as root, potentially compromising the entire device and any systems it manages.

Technologies: [Advantech EKI-1242IEIMS](https://junglewise.ai/threats/technologies/eki-1242ieims). Vendors: [Advantech](https://junglewise.ai/threats/vendors/advantech).

## Quick answers

**Is CVE-2026-73166 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73166 being exploited in the wild.

**How severe is CVE-2026-73166?** Informational severity, with a CVSS score of 8.6, published 16 September 2026.

**Which products and versions are affected?** Advantech EKI-1242IEIMS V1.06.01.

**Is there a fix for CVE-2026-73166?** A patch was published on 2026-09-04: Firmware version 2.00.01 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73166 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73166?** Check whether you run Advantech EKI-1242IEIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a CWE-94 code injection flaw in the web management interface of Advantech EKI-1242IEIMS firmware version V1.06.01. An authenticated remote attacker can inject arbitrary code that executes with root privileges on the device, including OS commands. The attack requires valid credentials but no user interaction. Nozomi Networks Labs discovered and reported the issue; a firmware update to version 2.00.01 is available to address the vulnerability.

## Affected products

- Advantech EKI-1242IEIMS V1.06.01

## Timeline

- 2026-09-16: disclosed
- 2026-09-04: patched: Firmware version 2.00.01 available

## References

- [https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf](https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf)
- [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73166](https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73166)

## Related threats

- [Advantech EKI-1242IEIMS OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-73176-advantech-eki-1242ieims-os-command-injection-in-web-management)
- [Advantech EKI-1242 denial of service in OPC UA gateway](https://junglewise.ai/threats/cve-2026-73175-advantech-eki-1242-denial-of-service-in-opc-ua-gateway)
- [Advantech EKI-1242 cleartext transmission of sensitive information](https://junglewise.ai/threats/cve-2026-73174-advantech-eki-1242-cleartext-transmission-of-sensitive)
- [Advantech EKI-1242IEIMS missing authentication in management protocol](https://junglewise.ai/threats/cve-2026-73173-advantech-eki-1242ieims-missing-authentication-in-management)
- [Advantech EKI-1242IEIMS arbitrary file overwrite in backup-restore](https://junglewise.ai/threats/cve-2026-73171-advantech-eki-1242ieims-arbitrary-file-overwrite-in-backup)