# CVE-2026-73172: Advantech EKI-1242EIMS OS command injection in edgserver management

Source: https://junglewise.ai/threats/cve-2026-73172-advantech-eki-1242eims-os-command-injection-in-edgserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73172 · Severity: info · CVSS 9.3 · Published 2026-09-16

The Advantech EKI-1242EIMS is an industrial network device used to manage and monitor critical infrastructure equipment. A remote attacker can execute arbitrary commands with root-level privileges on the device by sending crafted requests to its management service, potentially compromising network operations and providing a foothold for broader infrastructure attacks.

Technologies: [Advantech EKI-1242EIMS](https://junglewise.ai/threats/technologies/eki-1242eims). Vendors: [Advantech](https://junglewise.ai/threats/vendors/advantech).

## Quick answers

**Is CVE-2026-73172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73172 being exploited in the wild.

**How severe is CVE-2026-73172?** Informational severity, with a CVSS score of 9.3, published 16 September 2026.

**Which products and versions are affected?** Advantech EKI-1242EIMS V1.06.01.

**Is there a fix for CVE-2026-73172?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-73172 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73172?** Check whether you run Advantech EKI-1242EIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CWE-78 OS command injection vulnerability exists in the edgserver management service running on TCP port 5058 of the EKI-1242EIMS. The vulnerability stems from improper neutralization of special elements in OS commands, allowing unauthenticated remote attackers to inject arbitrary commands. No authentication is required, and the attack is network-reachable. Successful exploitation grants root-level command execution on the device. Advantech has released a patch in firmware version 2.00.01 to address this issue.

## Affected products

- Advantech EKI-1242EIMS V1.06.01

## Timeline

- 2026-09-16: disclosed

## References

- [https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf](https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf)
- [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73172](https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73172)

## Related threats

- [Advantech EKI-1242EIMS firmware signature verification bypass](https://junglewise.ai/threats/cve-2026-73177-advantech-eki-1242eims-firmware-signature-verification-bypass)
- [Advantech EKI-1242IEIMS OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-73176-advantech-eki-1242ieims-os-command-injection-in-web-management)
- [Advantech EKI-1242 denial of service in OPC UA gateway](https://junglewise.ai/threats/cve-2026-73175-advantech-eki-1242-denial-of-service-in-opc-ua-gateway)
- [Advantech EKI-1242 cleartext transmission of sensitive information](https://junglewise.ai/threats/cve-2026-73174-advantech-eki-1242-cleartext-transmission-of-sensitive)
- [Advantech EKI-1242IEIMS missing authentication in management protocol](https://junglewise.ai/threats/cve-2026-73173-advantech-eki-1242ieims-missing-authentication-in-management)