EUVD-2026-80730
GHSA-vrfh-mcm4-54wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege management credentials
-
DeliveryAccess Modbus CSV import workflow
-
ExploitUpload crafted CSV with embedded Lua
-
ExecutionInjected code interpreted and executed
-
ImpactArbitrary code execution on gateway
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated high-privilege session (PR:H) on the Advantech EKI-1242EIMS/EKI-1242IEIMS web management interface, plus the ability to reach and use the Modbus CSV import workflow to upload a crafted file. Exploitation is limited to firmware version V1.06.01. No user interaction beyond the attacker's own upload is needed (UI:N), but the mandatory privileged authentication is the primary limiting factor; a network path to the management interface is also required, which is typically restricted in properly segmented OT deployments. |
| Impact | This is a genuine but access-gated vulnerability. The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) is well-calibrated: the network vector and low attack complexity are offset by PR:H, meaning the attacker must already hold high-privilege authenticated access to the device's management interface before triggering the Modbus CSV import workflow. The full vulnerable-system triad (VC/VI/VA all High) reflects that arbitrary Lua code execution effectively compromises the device. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent widespread exploitation - this reads as a targeted, post-authentication risk rather than a mass-exploited threat. The PR:H requirement is the dominant limiting factor and substantially lowers real-world urgency versus a pre-auth flaw. Priority is moderate: patch during normal maintenance and restrict/monitor management access; it is not a drop-everything emergency absent exploitation evidence. No conflicting signals were detected between the CVSS vector and the description - both agree on remote, authenticated, code-execution semantics. |
| Exploit ScenarioDerived | An attacker who has obtained high-privilege credentials to the EKI-1242EIMS web management interface uploads a maliciously crafted Modbus CSV file through the import workflow. The embedded payload is interpreted as Lua code and executed on the gateway, giving the attacker arbitrary code execution on an OT-network device. No public exploit code was identified at time of analysis, so exploitation currently requires custom tooling plus valid privileged credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running firmware V1.06.01, because the Modbus CSV import workflow fails to neutralize code embedded in an uploaded configuration file (CWE-94). Exploitation requires an attacker to already hold a high-privilege authenticated session on the device web management interface and to be able to reach that interface over the network, which materially limits exposure in properly segmented OT environments; no user interaction on the part of a legitimate operator is needed, only the attacker's own crafted upload. Successful exploitation yields full loss of confidentiality, integrity, and availability of the device, but no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV); the vulnerability was identified by Nozomi Networks Labs and a vendor security advisory has been published.
RemediationAI
The primary fix is to move off vulnerable firmware: consult the Advantech security advisory for EKI-1242IEIMS (SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf) and apply the vendor-supplied firmware update for the EKI-1242EIMS/EKI-1242IEIMS that supersedes V1.06.01; no exact patched version string is confirmed in the available data, so validate the target release directly with Advantech or through the advisory before upgrading, and take a configuration backup first because firmware upgrades on these gateways can reset Modbus mappings. Until firmware is updated, the most effective compensating control is to remove reachability to the web management interface from anything but a dedicated, trusted management VLAN or jump host, since the exploit requires both privileged authentication and network access to that interface - the trade-off is loss of remote administration and a requirement for on-site or bastion-based access. Additionally, disable or tightly restrict the Modbus CSV import workflow where it is not operationally required, and where it is required, limit it to a single trusted operator account and only perform imports from locally attached media; the trade-off is a heavier, manual configuration/provisioning process. Do not expose the management interface to the internet or to general IT/OT flat networks, rotate management credentials, and monitor device logs for unexpected CSV imports, unsolicited reboots, configuration drift, or anomalous Lua-related errors as indicators of attempted exploitation. Because neither confirmed active exploitation (CISA KEV) nor public exploit code has been observed at time of analysis, emergency isolation is not mandated, but the above mitigations should be prioritized for internet-exposed or flat-network deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected Advantech EKI-1242EIMS/EKI-1242IEIMS are DIN-rail industrial Ethernet-to-serial/Modbus gateways whose management web interface supports importing Modbus register mapping definitions in CSV form. The import handler parses attacker-supplied CSV content and passes it into the device's embedded Lua scripting environment without adequate validation or escaping, which is the classic CWE-94 'Improper Control of Generation of Code' pattern: untrusted data from one context (a file field) is treated as code in another (a Lua interpreter), giving the attacker control over the generated program rather than just the data it consumes. Because the vulnerable logic runs inside the firmware itself, code executed this way inherits the privileges of the management service and can alter device configuration, disrupt Modbus/industrial communications, or serve as a pivot point inside an OT network. The CPE strings (cpe:2.3:a:advantech:eki-1242ieims and cpe:2.3:a:advantech:eki-1242eims) confirm both the EKI-1242IEIMS and EKI-1242EIMS SKUs are in scope, with the reported impact confined to firmware version V1.06.01. The upstream CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, 8.6) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) agree on the essentials: network reachable, low attack complexity, privileged authentication required, no user interaction, and high impact on the vulnerable component only, with no demonstrated impact on downstream/connected systems.
Know when Eki 1242Ieims gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote management interface reachable over network (AV:N/AC:L) but code injection requires high-privilege authenticated access (PR:H); Lua execution fully compromises the device (C/I/A:H, S:U).
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
DescriptionCVE.org
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a crafted imported file.
Executive ViewAI
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running firmware V1.06.01 are affected by a high-severity code-execution flaw that can fully compromise the device when an attacker already holds a high-privilege session on its web management interface. For leadership, the operational concern is loss of confidentiality, integrity, and availability of these OT gateways, which could disrupt industrial monitoring or control if the management interface is reachable from untrusted networks or shared with excessive privileges. No public exploit identified at time of analysis and no confirmation of active exploitation (not listed in CISA KEV), so priority should focus on exposure reduction and privileged-access control.
No vendor-released patch identified at time of analysis; interim mitigations include restricting the web management interface on all Advantech EKI-1242EIMS and EKI-1242IEIMS firmware V1.06.01 devices to trusted administrative networks and hosts, disabling remote management where feasible, enforcing least-privilege and strong authentication for device administrators, monitoring for unexpected CSV uploads or configuration changes, and segmenting these Modbus gateways from untrusted IT/OT networks. Monitor Advantech advisory for a firmware fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Eki 1242Ieims
View allUnauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gat
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industria
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices runn
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01)
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industr
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIM
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI
Exploit-DB