EUVD-2026-80729Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web interface with low complexity but requiring high-privilege admin auth (PR:H); arbitrary file overwrite enables full device compromise, so C/I/A all High, scope unchanged.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
3DescriptionCVE.org
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.
AnalysisAI
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIMS) firmware V1.06.01 allows an attacker who already holds administrative credentials on the device's web management interface to upload a crafted backup archive whose internal file names/paths are not validated, causing arbitrary files on the device filesystem to be overwritten. The result is complete loss of confidentiality, integrity and availability for the device itself (CVSS 4.0 base 8.6; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), making it a genuine but authentication-gated risk in a niche OT/industrial networking device rather than a pre-auth compromise path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the device's web management interface and (2) valid high-privilege/administrative authentication to that interface (PR:H) - the attacker must be able to invoke the backup-restore workflow, which is an authenticated administrative function. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but authentication-gated integrity/availability issue in a niche OT device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched firmware version is confirmed in the available data, so the primary action is to consult the Advantech security advisory (https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf) and the Nozomi Networks Labs advisory (https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73171) to obtain the vendor-designated fixed firmware for the EKI-1242EIMS/EKI-1242IEIMS family and, where the vendor states that V1.06.01 is affected, move affected units off that release; until a fix is applied, treat any backup archive as untrusted input and do not restore archives of unknown provenance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Advantech EKI-1242EIMS and EKI-1242IEIMS units and confirm which run firmware V1.06.01, then immediately block management-interface access from the internet and from untrusted network segments via firewall or ACL rules, verify no administrative account is still using default or vendor-shipped credentials, and restrict backup-archive upload privileges on the web management interface to the smallest possible set of trusted administrators; enable and forward device audit logs to the SOC for monitoring of restore operations and file-upload activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eki 1242Ieims
View allUnauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gat
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industria
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industr
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices runn
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01)
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today