Nozomi Networks Labs identified a CWE-78 OS command injection vulnerability in the Advantech EKI-1242IEIMS device's web management interface in firmware version V1.06.01. The flaw allows a remote attacker with authentication privileges to execute arbitrary operating system commands with root privileges by crafting specific request parameters. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

An authenticated remote attacker can execute arbitrary OS commands as root on the affected device, potentially leading to full system compromise. This can impact the confidentiality, integrity, and availability of the device and its managed network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, it is recommended to monitor the vendor's security advisories for updates. Until a fix is available, restrict access to the web management interface to trusted administrators only and consider additional network-level protections to limit exposure.