This vulnerability (CVE-2026-73167) involves improper neutralization of special elements used in OS commands (CWE-78) in the Advantech EKI-1242IEIMS device's web management interface. Specifically, in firmware versions up to and including 1.06.01, a remote attacker who is authenticated with high privileges can exploit crafted request parameters to execute arbitrary OS commands with root privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a remote authenticated attacker with high privileges to execute arbitrary OS commands as root on the affected device. This can lead to full system compromise, including unauthorized control over device functions and potentially the network environment it resides in.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Advantech's advisories for updates. Until a fix is available, restrict access to the web management interface to trusted administrators and consider additional network-level protections to limit exposure.