CVE-2026-73173
HighCVSS 8.8Summary
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.
Risk Assessment
An unauthenticated attacker can remotely reconfigure, reboot, reset, or upgrade the device, leading to full control and disruption of the industrial network. This may result in persistent configuration damage and service unavailability.
Recommendation
Immediately restrict access to TCP port 5058 to trusted networks only and upgrade the firmware to a version containing the fix. Also implement authentication and network segmentation for management traffic.
Other vulnerabilities in Advantech EKI-1242EIMS
See all- CVE-2026-73177High
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.
- CVE-2026-73175High
A CWE-400: Uncontrolled Resource Consumption vulnerability exists in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server session pool and cause a complete denial of service to all legitimate OPC UA clients by opening multiple anonymous sessions.
- CVE-2026-73174High
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata in cleartext.
- CVE-2026-73171High
A CWE-73: External Control of File Name or Path vulnerability exists in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.
- CVE-2026-73170High
A CWE-94 code injection vulnerability was identified in the Modbus CSV import workflow of Advantech EKI-1242EIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary Lua code on the device via a crafted imported file.
- CVE-2026-73169Medium
Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store malicious script content that executes in the browser of any administrator who later opens an affected management page.
- CVE-2026-73172Critical
Nozomi Networks Labs identified a CWE-78 (OS Command Injection) vulnerability in the edgserver management service of Advantech EKI-1242EIMS firmware version V1.06.01. It allows a remote unauthenticated attacker to execute arbitrary OS commands as root via crafted requests to TCP port 5058.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.