CVE-2026-19535 | Nozomi Networks Labs

Join us at Spark 2026 - Nozomi Networks' Customer Conference!

Summary

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface.

Impact

A remote unauthenticated attacker may perform unauthorized state-changing requests on behalf of a logged-in administrator, enabling unauthorized access to privileged management functions

Issue Date

September 16, 2026

Affects

This issue affects: Advantech EKI-1242IEIMS and EKI-1242EIMS in firmware version V1.06.01.

CVE Name

CVE-2026-19535

CVSS Details

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score

8.6

Solution

Update to firmware version 2.00.01.

Mitigations

Acknowledgements

Simone Bossi at Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more

Nozomi Networks Threat Intelligence dashboard showing pie charts of targeted industries, countries, and malware types, with detailed threat actor and vulnerability information below.

Latest Labs Blogs

Discover how easy it is to identify and respond to cyber threats by automating your OT and IoT asset discovery, inventory and management.

Request a Demo Watch Demo

Cross-Site Request Forgery (CSRF)

Summary

Impact

Issue Date

Affects

CVE Name

CVSS Details

CVSS Score

Solution

Mitigations

Acknowledgements

Nozomi Threat Intelligence

Latest Labs Blogs

Exploiting the Edge: Vulnerabilities in the Siemens SCALANCE LPE9403

Fuzzing Siemens PROFINET DCP: An Emulation-Driven Approach with Unicorn-AFL

KATARU: IoT Malware Adopts Public LPE Exploits

Take the next step.

Subscribe

LinkedIn

Demo

PLATFORM

Professional Services

Solutions: Business needs

Solutions: Compliance

Solutions: Industry

Learn