Advantech vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-43858 A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.High 8.6 · Oct 20, 2026
• CVE-2026-43857 A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.High 8.6 · Oct 20, 2026
• CVE-2026-43856 A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code executioHigh 8.6 · Oct 20, 2026
• CVE-2026-43855 A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.High 7.5 · Oct 20, 2026
• CVE-2026-43853 A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.High 8.2 · Oct 20, 2026
• CVE-2026-43852 A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.High 8.2 · Oct 20, 2026
• CVE-2026-43851 A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.High 8.2 · Oct 20, 2026
• CVE-2026-43850 A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.High 8.6 · Oct 20, 2026
• CVE-2026-43847 A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancemenHigh 8.2 · Oct 20, 2026
• CVE-2026-43846 A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.High 8.6 · Oct 20, 2026
• CVE-2026-43845 A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.Critical 9.2 · Oct 20, 2026
• CVE-2026-43844 A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.Critical 9.3 · Oct 20, 2026
• CVE-2026-43839 A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.High 8.7 · Oct 20, 2026
• CVE-2026-43838 A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.Critical 9.2 · Oct 20, 2026
• CVE-2026-43837 A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.High 7.5 · Oct 20, 2026
• CVE-2026-43836 A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.Critical 9.3 · Oct 20, 2026
• CVE-2026-43835 A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising tHigh 8.6 · Oct 20, 2026
• CVE-2026-43834 A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.High 7.5 · Oct 20, 2026
• CVE-2026-73177 Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1High 8.6 · Sep 16, 2026
• CVE-2026-73176 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web maHigh 8.6 · Sep 16, 2026
• CVE-2026-73175 Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmwareHigh 7.1 · Sep 16, 2026
• CVE-2026-73174 Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1High 8.7 · Sep 16, 2026
• CVE-2026-73173 Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242High 8.8 · Sep 16, 2026
• CVE-2026-73172 Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserCritical 9.3 · Sep 16, 2026
• CVE-2026-73171 Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmwaHigh 8.6 · Sep 16, 2026