Advantech EKI-1242EIMS vulnerabilities

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.

A CWE-400: Uncontrolled Resource Consumption vulnerability exists in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server session pool and cause a complete denial of service to all legitimate OPC UA clients by opening multiple anonymous sessions.

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata in cleartext.

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.

A CWE-73: External Control of File Name or Path vulnerability exists in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.

A CWE-94 code injection vulnerability was identified in the Modbus CSV import workflow of Advantech EKI-1242EIMS firmware V1.06.01. A remote authenticated attacker can execute arbitrary Lua code on the device via a crafted imported file.

Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store malicious script content that executes in the browser of any administrator who later opens an affected management page.

Nozomi Networks Labs identified a CWE-78 (OS Command Injection) vulnerability in the edgserver management service of Advantech EKI-1242EIMS firmware version V1.06.01. It allows a remote unauthenticated attacker to execute arbitrary OS commands as root via crafted requests to TCP port 5058.