Nozomi Networks Labs discovered that the web management interface of Advantech EKI-1242IEIMS contains an OS Command Injection flaw. The vulnerability permits an attacker who can authenticate to the interface to supply crafted request parameters that are passed to the operating system without proper sanitization. An attacker can thus execute arbitrary commands with root privileges, compromising the entire device.

The issue affects Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware version V1.06.01. The vulnerability is present only in this firmware release; no other versions are listed in the advisory.

The CVSS score of 8.6 indicates a high severity. The EPSS score is less than 1 %, suggesting low current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves sending crafted request parameters to the web management interface of the device. The flaw requires authenticated access to the interface; an attacker who has valid credentials can send crafted request parameters that cause the device to execute arbitrary OS commands as root. Successful exploitation would give the attacker root privilege, permitting full control of the device and any services it hosts.