CVE-2026-73172

Executive Summary

CVE-2026-73172 is an OS command injection vulnerability (CWE-78) in the edgserver management service of Advantech EKI-1242EIMS, affecting firmware version V1.06.01. A remote, unauthenticated attacker can send crafted requests to TCP port 5058 to execute arbitrary OS commands with root privileges. The flaw was identified by Nozomi Networks Labs and, at the time of writing, remains unpatched with no known public proof-of-concept or in-the-wild exploitation reported.

Technical Analysis

The vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). This class of weakness occurs when an application constructs an operating system command using externally supplied input without adequately sanitizing or escaping shell metacharacters, allowing an attacker to inject and execute arbitrary commands.

In this case, the affected component is the edgserver management service listening on TCP port 5058 on the Advantech EKI-1242EIMS running firmware V1.06.01. The attack surface is the network-exposed management interface: a remote attacker sends a request to port 5058, and the service passes attacker-controlled data into an OS command invocation. Because processing does not neutralize special elements before command execution, injected commands run in the service's execution context, which per the description grants root privileges. The unauthenticated nature of the attack means no credentials or prior access are required to reach the vulnerable code path.

The NVD description provides no further implementation detail — the specific parameter, endpoint, or function within edgserver that is vulnerable is not disclosed. Accordingly, this report does not speculate on internal function names, request parameters, or code paths beyond the class-level mechanism described above. No CVE has been assigned a CVSS score in the provided data (Score: N/A), and no EPSS score is yet available from FIRST.org.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public proof-of-concept exists; the exact request format is not documented.

1. Reconnaissance / target identification. An adversary scans for Advantech EKI-1242EIMS devices exposing the management service on TCP port 5058. Industrial/edge deployments of these devices are frequently reachable from untrusted or flat networks, making internet- or VPN-adjacent discovery plausible.

2. Triggering the flaw class. Because the flaw is an unauthenticated OS command injection, the attacker must identify a request to edgserver on port 5058 that carries attacker-controlled input which the service fails to sanitize before use in a shell command. The specific request field is not publicly documented; the attacker would need to probe the service's management operations to locate the injectable input.

3. Payload execution. The injected input is concatenated into an OS command by the service. As the injected content is not neutralized (CWE-78), shell metacharacters embedded in the request cause the service to execute arbitrary commands. Per the description, execution occurs as root, so commands run with full system privileges.

4. Post-exploitation impact. Successful exploitation yields root-level remote command execution on the device. This enables attacker control over the edge device, potential lateral movement within the operational network, and disruption or manipulation of the industrial environment the device serves. No public exploitation evidence or campaign attribution is available.

Impact Assessment

The confidentiality, integrity, and availability impact is total for the affected device if the CVSS vector above is applied: unauthenticated (PR:N) remote (AV:N) code execution with high impact across all three security properties. A root-level command injection in a management service is exceptionally severe for OT/edge deployments: it can lead to device takeover, configuration tampering, traffic manipulation, and use as a pivot point into segmented industrial networks. The blast radius is not limited to the compromised host — EKI edge devices commonly sit at trust boundaries between IT and OT, so a single compromise can expose downstream control systems. Because the vulnerability requires no authentication and no user interaction, any network-reachable instance of the affected firmware is effectively a high-value target. Note: no CVSS score was published in the provided data; the vector above reflects the vulnerability class and disclosed impact and should be treated as analyst-applied.

Detection Guidance

Sigma Rule

title: Advantech EKI-1242EIMS edgserver OS Command Injection Attempt (CVE-2026-73172)
id: 9b1c7e42-2026-7a31-bb72-000000000001
status: experimental
description: Detects suspicious activity targeting the edgserver management service on TCP 5058, consistent with OS command injection exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73172
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: firewall
detection:
  selection_port:
    dst_port: 5058
  selection_metachar:
    payload|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
      - '|'
  condition: selection_port and selection_metachar
falsepositives:
  - Legitimate management traffic containing shell metacharacters (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.73172

YARA Rule

rule CVE_2026_73172_Advantech_edgserver_RCE
{
    meta:
        author = "valtersit.com"
        description = "Detects OS command injection payloads targeting Advantech EKI-1242EIMS edgserver (CVE-2026-73172)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73172"
        date = "2026-01-01"

    strings:
        $s1 = "edgserver" ascii nocase
        $m1 = ";" ascii
        $m2 = "&&" ascii
        $m3 = "||" ascii
        $m4 = "$(" ascii
        $bin = "/bin/sh" ascii
        $cmd = "wget " ascii nocase

    condition:
        ($s1 or $bin) and any of ($m*)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 5058 (msg:"CVE-2026-73172 Advantech EKI-1242EIMS edgserver OS Command Injection Attempt"; flow:to_server,established; content:"|3B|"; pcre:"/(;|\x26\x26|\x7C\x7C|\x60|\x24\x28)/i"; classtype:attempted-admin; sid:90073172; rev:1; reference:cve,2026-73172; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by destination.ip with maxspan=10s
  [network where destination.port == 5058 and network.transport == "tcp"]
  [network where destination.port == 5058 and
     (network.protocol == "http" and
      (url.query : ("*;*" or "*&&*" or "*||*" or "*$(*" or "*`*")))]

Splunk SPL Query

index=network OR index=firewall sourcetype=*traffic*
| search dest_port=5058
| eval payload=_raw
| where match(payload, "(?i)(;|&&|\|\||\$\(|`)\s*(id|whoami|cat |wget |curl |nc |/bin/sh|sh )")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by dest_ip
| where count > 0

Wazuh OSSEC Rule

<group name="advantech,cve-2026-73172,">
  <rule id="100731" level="12">
    <if_sid>0</if_sid>
    <decoded_as>json</decoded_as>
    <field name="dst_port">5058</field>
    <field name="payload">\.*[;&|`]|\$\(</field>
    <description>CVE-2026-73172: Possible OS command injection attempt against Advantech edgserver (TCP 5058)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Isolate affected devices: block or restrict TCP port 5058 to a hardened management VLAN; never expose the edgserver service to the internet or untrusted networks.
   • Apply firewall and ACL controls to allow only trusted management hosts to reach the management interface.
   • Segment OT/edge devices from IT networks; enforce least-privilege network access and monitor for unexpected east-west traffic.
   • Deploy the detection rules above to alert on suspicious requests to port 5058.

2. Patch/upgrade steps.

   • No vendor patch or fixed firmware version is currently identified. Monitor Advantech security advisories and Nozomi Networks Labs advisories for a firmware update beyond V1.06.01.
   • Engage Advantech support directly to confirm remediation status and request a fixed firmware build.
   • Until a patch is available, maintain compensating network controls and consider device replacement where the risk is unacceptable.

3. Long-term hardening.

   • Establish an inventory and vulnerability-tracking process for edge/OT devices and their firmware.
   • Disable unused management services and change default configurations where possible.
   • Enforce network segmentation and monitoring for OT protocols and management planes.
   • Adopt a firmware update cadence and require vendor security advisories as part of procurement.

References

• NVD — CVE-2026-73172: https://nvd.nist.gov/vuln/detail/CVE-2026-73172
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• Nozomi Networks Labs (crediting researcher): https://www.nozominetworks.com/labs (vendor research page; specific advisory not provided)
• Advantech Security Advisories: https://www.advantech.com/en/support/security (vendor advisory portal)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed as of this report)

Note: No threat actor campaigns, exploit-in-the-wild evidence, or public proof-of-concept were identified in the provided data. EPSS score is not yet available. All exploitation details are inferred from the disclosed vulnerability class.