CVE-2026-73172: Advantech EKI-1242EIMS RCE Vulnerability

CVE-2026-73172 Overview

CVE-2026-73172 is an OS command injection vulnerability [CWE-78] in the edgserver management service of the Advantech EKI-1242EIMS industrial protocol gateway running firmware version V1.06.01. A remote, unauthenticated attacker can send crafted requests to TCP port 5058 to execute arbitrary operating system commands as root. Nozomi Networks Labs identified and reported the issue to Advantech. Because the affected device is an industrial edge gateway commonly deployed in operational technology (OT) environments, successful exploitation grants full control of a device that bridges enterprise networks and field equipment.

Critical Impact

Unauthenticated remote code execution as root on Advantech EKI-1242EIMS gateways via TCP port 5058, exposing OT networks to full device compromise.

Affected Products

• Advantech EKI-1242EIMS industrial protocol gateway
• Firmware version V1.06.01
• edgserver management service listening on TCP port 5058

Discovery Timeline

• 2026-09-16 - CVE-2026-73172 published to the National Vulnerability Database (NVD)
• 2026-09-16 - Last updated in the NVD database
• Vulnerability reported by Nozomi Networks Labs; see the Nozomi Networks CVE-2026-73172 Advisory and the Advantech Security Advisory EKI-1242IEIMS

Technical Details for CVE-2026-73172

Vulnerability Analysis

The flaw resides in the edgserver process, a management daemon that listens on TCP port 5058 on the EKI-1242EIMS gateway. The service accepts network requests without authentication and passes attacker-controlled input into an operating system command handler. Because input is not neutralized before being executed by the underlying shell, attackers can append arbitrary commands to the intended operation. The daemon runs as root, so injected commands inherit full privileges on the device.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The edgserver code path constructs a shell command using unvalidated fields from the network request. Metacharacters such as ;, |, &, and backticks are not filtered or escaped, allowing command concatenation. Combined with the absence of authentication on the listening port, this creates a direct path from unauthenticated network access to root-level command execution.

Attack Vector

Exploitation requires only network reachability to TCP port 5058 on a vulnerable EKI-1242EIMS device. An attacker sends a crafted request to the edgserver service containing a payload with shell metacharacters and injected commands. The service executes the composite command as root, giving the attacker firmware-level control: credential extraction, configuration tampering, persistence, protocol traffic manipulation, and pivoting into connected OT segments. No user interaction is required. Refer to the vendor and researcher advisories linked above for protocol-level details.

Detection Methods for CVE-2026-73172

Indicators of Compromise

• Inbound TCP connections to port 5058 on EKI-1242EIMS devices from hosts outside expected management workstations
• Unexpected outbound connections initiated by the gateway, such as reverse shells or file downloads
• New or modified files in firmware-writable locations and unexpected processes spawned by edgserver
• Configuration changes to gateway protocol mappings or user accounts with no corresponding change record

Detection Strategies

• Deploy OT-aware network monitoring to inspect traffic to TCP port 5058 and alert on payloads containing shell metacharacters (;, |, &, `, $()
• Baseline normal edgserver request patterns and flag deviations in request size, frequency, or source
• Correlate gateway connection logs with authenticated management sessions to surface unauthenticated access attempts

Monitoring Recommendations

• Forward gateway syslog and network flow records into a centralized analytics platform such as Singularity Data Lake for retention and correlation with enterprise telemetry
• Monitor north-south and east-west flows between IT and OT zones for anomalous connections originating from Advantech gateways
• Track firmware version inventory to identify devices still running V1.06.01

How to Mitigate CVE-2026-73172

Immediate Actions Required

• Restrict network access to TCP port 5058 on all EKI-1242EIMS devices to a dedicated management VLAN using firewall or ACL rules
• Inventory all Advantech EKI-1242EIMS gateways and identify units running firmware V1.06.01
• Apply the patched firmware referenced in the Advantech Security Advisory EKI-1242IEIMS as soon as it is validated in a test environment
• Rotate any credentials, keys, or configuration secrets stored on potentially exposed devices

Patch Information

Advantech has published a security advisory for the EKI-1242IEIMS product line addressing this vulnerability. Refer to the Advantech Security Advisory EKI-1242IEIMS for the fixed firmware version and installation procedure. Coordinate deployment with OT change management to avoid production disruption.

Workarounds

• Block TCP port 5058 at the network perimeter and at the OT boundary firewall until patched firmware is deployed
• Place vulnerable gateways behind a jump host and require VPN or bastion access for any management traffic
• Disable or isolate devices that cannot be patched and cannot be network-restricted
• Enable OT network segmentation to prevent lateral movement from a compromised gateway into control networks

# Example: restrict access to edgserver TCP/5058 to a management subnet
# (adapt to your upstream firewall syntax)
iptables -A FORWARD -p tcp --dport 5058 -s 10.10.20.0/24 -d 10.50.0.0/16 -j ACCEPT
iptables -A FORWARD -p tcp --dport 5058 -d 10.50.0.0/16 -j DROP