Is CVE-2026-73172 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73172 being exploited in the wild.

How severe is CVE-2026-73172?

Informational severity, with a CVSS score of 9.3, published 16 September 2026.

Which products and versions are affected?

Advantech EKI-1242EIMS V1.06.01.

Is there a fix for CVE-2026-73172?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-73172 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73172?

Check whether you run Advantech EKI-1242EIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73172: Advantech EKI-1242EIMS OS command injection in edgserver management

CVE-2026-73172 · Severity: info · CVSS 9.3 · Published 2026-09-16

The Advantech EKI-1242EIMS is an industrial network device used to manage and monitor critical infrastructure equipment. A remote attacker can execute arbitrary commands with root-level privileges on the device by sending crafted requests to its management service, potentially compromising network operations and providing a foothold for broader infrastructure attacks.

Technologies: Advantech EKI-1242EIMS. Vendors: Advantech.

Quick answers

Is CVE-2026-73172 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73172 being exploited in the wild.
How severe is CVE-2026-73172?: Informational severity, with a CVSS score of 9.3, published 16 September 2026.
Which products and versions are affected?: Advantech EKI-1242EIMS V1.06.01.
Is there a fix for CVE-2026-73172?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-73172 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73172?: Check whether you run Advantech EKI-1242EIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A CWE-78 OS command injection vulnerability exists in the edgserver management service running on TCP port 5058 of the EKI-1242EIMS. The vulnerability stems from improper neutralization of special elements in OS commands, allowing unauthenticated remote attackers to inject arbitrary commands. No authentication is required, and the attack is network-reachable. Successful exploitation grants root-level command execution on the device. Advantech has released a patch in firmware version 2.00.01 to address this issue.

Affected products

Advantech EKI-1242EIMS V1.06.01

Timeline

2026-09-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.