Advantech vulnerabilities and threats

A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.

A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.

A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.

A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.

CVE-2026-73177 is a high-severity vulnerability in the Advantech EKI-1242IEIMS device firmware version 1.06.01 and earlier. The firmware upgrade mechanism does not verify the cryptographic signature or certificate of firmware images uploaded via the authenticated web management interface. This allows an authenticated administrator-level attacker to install arbitrary modified firmware, leading to full persistent compromise of the device.

CVE-2026-73176 is a high-severity OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS devices. It affects firmware versions from 0 up to and including 1.06.01. A remote authenticated attacker can exploit this flaw by sending crafted request parameters to execute arbitrary OS commands with root privileges.

CVE-2026-73175 is a high-severity vulnerability in the OPC UA gateway component of the Advantech EKI-1242IEIMS device firmware version 1.06.01 and earlier. It allows an adjacent unauthenticated attacker to exhaust the server session pool by opening multiple anonymous sessions, resulting in a denial of service for legitimate OPC UA clients.

CVE-2026-73174 is a high-severity vulnerability in the Advantech EKI-1242IEIMS device firmware version V1.06.01. It involves cleartext transmission of sensitive information via the edgserver management protocol, allowing a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata.

CVE-2026-73173 is a high-severity vulnerability in Advantech EKI-1242IEIMS firmware version 1.06.01 and earlier. It involves missing authentication for critical functions in the edgserver management protocol, allowing remote unauthenticated attackers to perform sensitive device-management actions such as network reconfiguration, reboot, reset, and firmware upgrade via TCP port 5058.

CVE-2026-73172 is a critical OS command injection vulnerability in the Advantech EKI-1242IEIMS device. It affects the edgserver management service in firmware version V1.06.01 and earlier. An unauthenticated remote attacker can send crafted requests to TCP port 5058 to execute arbitrary OS commands with root privileges.

CVE-2026-73171 is a high-severity vulnerability in Advantech EKI-1242IEIMS firmware version 1.06.01 and earlier. It involves external control of file name or path (CWE-73) in the backup-restore workflow, allowing a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive via the web management interface.

CVE-2026-73170 is a high-severity vulnerability in Advantech EKI-1242IEIMS firmware version V1.06.01. It involves improper control of code generation (CWE-94) in the Modbus CSV import workflow, allowing a remote authenticated attacker to execute arbitrary Lua code on the device via a crafted imported file.

CVE-2026-73169 is a cross-site scripting (XSS) vulnerability in the Modbus transaction management interface of Advantech EKI-1242IEIMS firmware version 1.06.01 and earlier. It allows a remote authenticated attacker to store malicious script content that executes in the browser of any administrator who views the affected management page. This vulnerability requires authentication and user interaction to exploit and has a medium severity rating.

CVE-2026-73167 is an OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS firmware version V1.06.01. It allows a remote authenticated attacker to execute arbitrary OS commands as root by sending crafted request parameters. The vulnerability is identified as CWE-78 and has a high severity score of 8.6. No known exploits are reported in the wild. The affected versions include all firmware versions from 0 up to and including 1.06.01.

CVE-2026-73166 is a high-severity code injection vulnerability (CWE-94) in the web management interface of the Advantech EKI-1242IEIMS device. It affects firmware version V1.06.01 and earlier. A remote authenticated attacker can exploit this flaw to execute arbitrary code, including OS commands with root privileges on the device.

CVE-2026-73165 is an OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS firmware version V1.06.01. It allows a remote authenticated attacker to execute arbitrary OS commands as root by sending crafted request parameters. The vulnerability is classified as CWE-78 and has a high severity with a CVSS 4.0 score of 8.6.

CVE-2026-73164 is an OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS firmware version V1.06.01. It allows a remote authenticated attacker to execute arbitrary OS commands as root by sending crafted request parameters. The vulnerability is classified as CWE-78 and has a high severity with a CVSS score of 8.6.

CVE-2026-73163 is a high-severity OS command injection vulnerability in the web management interface of Advantech EKI-1242IEIMS devices. It affects firmware versions up to and including V1.06.01. A remote authenticated attacker can exploit this flaw by sending crafted request parameters to execute arbitrary OS commands with root privileges.

A Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) exists in the LuCI administrative web interface of Advantech EKI-1242IEIMS firmware version V1.06.01. This flaw allows a remote unauthenticated attacker to perform unauthorized state-changing requests on behalf of a logged-in administrator, potentially granting access to privileged management functions.