EUVD-2026-80731Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS reachable only by a high-privilege authenticated user (PR:H) and requiring a victim admin to open the page (UI:R); script executes outside the vulnerable component (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
1DescriptionCVE.org
Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store malicious script content that executes in the browser of any administrator who later opens an affected management page.
AnalysisAI
Stored cross-site scripting in the Modbus transaction management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privileged authenticated access to the gateway web UI persist malicious script that later executes in the browser of any administrator who opens the affected management page. Because the payload is stored and served from the device itself, the more serious consequences land in the victim administrator's browser session (scope change to High per the CVSS:4.0 vector, and C:H/I:H/S:H in the 3.1 assessment) while impact on the gateway itself is limited to Low confidentiality and integrity, with no availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold high-privilege authenticated access to the EKI-1242EIMS web management interface (PR:H) in order to write malicious script into the Modbus transaction management interface, and the stored payload only executes when a separate administrator subsequently opens the affected management page (UI:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored/persistent cross-site scripting flaw (CWE-79) in the Modbus transaction management interface of the Advantech EKI-1242EIMS industrial gateway. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor advisory published; an exact patched firmware version is not specified in the available data, so administrators should consult the Advantech security advisory (https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf) and the Nozomi Networks Labs advisory (https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73169) to obtain the fixed firmware release and apply it to all EKI-1242EIMS and EKI-1242IEIMS units, prioritizing devices running V1.06.01. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eki 1242Ieims
View allUnauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gat
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industria
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIM
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industr
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices runn
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01)
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today