EMAG Security Advisory EMAG-SA-2026-001: Security Vulnerabilities in the Web Container of Remote Maintenance Routers

Published: November 3, 2026 | Version 1.0

Summary
The web container of the INSYS-icom remote maintenance routers installed in EMAG machines runs a software version that is affected by known security vulnerabilities (including CVE-2026-109618 and CVE-2026-109619). The router front end itself is not affected.

Affected Products
EMAG machines with an INSYS-icom remote maintenance router and an activated EMAG web container.

Description
The web container provides a page for testing the VPN connection; on older routers, it also provides a page for setting a static IP address. The security vulnerabilities could allow an attacker to take control of the container.

Impact
The web container is accessible exclusively from the machine network, not from the customer network, the Internet, or via the VPN connection. An attack therefore requires access to the machine network.
Depending on the router’s configuration, an attacker could modify or read the router’s configuration. Since the configuration status cannot be determined from the outside, the worst-case scenario should be assumed as a precaution.

Mitigation Measures
The web container is not required for production operation and should be disabled. Disabling it requires administrator access to the router and will therefore be performed by EMAG. Please contact product.securitynoSpam@emag.com with the machine number.
Additionally, we recommend restricting access to the machine network to only the necessary systems.

Status
EMAG is considering removing the web container by default in the future. To date, there have been no reports of these security vulnerabilities being exploited on EMAG machines.

Contact
product.securitynoSpam@emag.com

Back to overview