CVE-2026-73171
HighCVSS 8.6Summary
A CWE-73: External Control of File Name or Path vulnerability exists in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.
Risk Assessment
An attacker with valid credentials can overwrite arbitrary files on the device filesystem, potentially leading to system corruption, persistent compromise, or denial of service. This may result in loss of device integrity and the need for reimaging.
Recommendation
Restrict access to the web interface to trusted networks only and upgrade the firmware to a version containing the fix. Also verify the integrity of backup files before restoring them.
Other vulnerabilities in Advantech EKI-1242EIMS
See all- CVE-2026-73177High
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.
- CVE-2026-73175High
A CWE-400: Uncontrolled Resource Consumption vulnerability exists in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server session pool and cause a complete denial of service to all legitimate OPC UA clients by opening multiple anonymous sessions.
- CVE-2026-73174High
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata in cleartext.
- CVE-2026-73173High
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.
- CVE-2026-73170High
A CWE-94 code injection vulnerability was identified in the Modbus CSV import workflow of Advantech EKI-1242EIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary Lua code on the device via a crafted imported file.
- CVE-2026-73169Medium
Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store malicious script content that executes in the browser of any administrator who later opens an affected management page.
- CVE-2026-73172Critical
Nozomi Networks Labs identified a CWE-78 (OS Command Injection) vulnerability in the edgserver management service of Advantech EKI-1242EIMS firmware version V1.06.01. It allows a remote unauthenticated attacker to execute arbitrary OS commands as root via crafted requests to TCP port 5058.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.