Quick answers
- Is CVE-2026-73167 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-73167 being exploited in the wild.
- How severe is CVE-2026-73167?
- Informational severity, with a CVSS score of 8.6, published 16 September 2026.
- Which products and versions are affected?
- Advantech EKI-1242EIMS V1.06.01; Advantech EKI-1242IEIMS V1.06.01.
- Is there a fix for CVE-2026-73167?
- A patch was published on 2026-09-16: Firmware version 2.00.01 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-73167 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-73167?
- Check whether you run Advantech EKI-1242EIMS or Advantech EKI-1242IEIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an OS command injection (CWE-78) in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01. The issue stems from improper neutralization of special elements in request parameters, allowing a remote authenticated attacker to inject and execute arbitrary OS commands with root privileges. The attack requires valid authentication credentials and network access to the management interface; no user interaction is needed. An attacker can achieve full command execution as root. The vendor has released a patch in firmware version 2.00.01.
Affected products
- Advantech EKI-1242IEIMS V1.06.01
- Advantech EKI-1242EIMS V1.06.01
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Firmware version 2.00.01 available