EUVD-2026-80727
GHSA-r838-p3xg-9mfp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach management network TCP 5058
-
DeliverySend crafted edgserver request
-
ExploitBypass missing authentication
-
ExecutionInvoke firmware upgrade / reset
-
ImpactReconfigure or brick gateway
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to TCP port 5058 (the edgserver management protocol) on an Advantech EKI-1242EIMS or EKI-1242IEIMS gateway running firmware V1.06.01 - no authentication, credentials, or user interaction are needed (CWE-306). The primary limiting factor is network exposure: these are OT/industrial gateways typically deployed behind segmented networks, so the attacker must first reach the management segment. There is no confidentiality impact (VC:N); the concrete capabilities exposed are network reconfiguration, reboot, reset, and firmware upgrade. |
| Impact | This is a genuine pre-authentication issue and should be treated as a real priority within its niche. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation with no user interaction - the description matches, since any attacker with TCP reach to port 5058 can invoke privileged device-management functions. Impact is integrity/availability only (VI:H/VA:H, VC:N): the flaw does not read data but permits network reconfiguration, reboot, reset, and - critically - firmware upgrade, which is an integrity-destroying vector that can lead to full device compromise or bricking. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active or automated exploitation; the 8.8 score reflects capability, not observed activity. The realistic risk is bounded by exposure: EKI-1242EIMS gateways are niche OT equipment that should sit on isolated networks, so widespread internet-facing exploitation is unlikely, but any attacker who reaches the management segment has a trivial, reliable path to disrupt or reflash the device. Note this is a distinct, lower-scored sibling of the OS-command-injection RCE CVE-2026-73172 (9.3) on the same firmware/port. |
| Exploit ScenarioDerived | An attacker with network access to an EKI-1242EIMS/IEIMS gateway's management interface sends crafted requests to TCP port 5058 without any credentials, invoking device-management functions directly. They push a malicious or arbitrary firmware image (or simply issue repeated reboot/reset/reconfiguration commands) to take over or permanently disrupt the industrial gateway. No public exploit code is identified at time of analysis, but the low complexity and absence of authentication make weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management protocol on TCP port 5058 without any authentication, allowing a remote unauthenticated attacker who can reach that port to invoke critical device-management functions such as network reconfiguration, reboot, reset, and firmware upgrade. The flaw is a CWE-306 missing authentication for critical function issue with CVSS 8.8 (v4.0) and an independently assessed CVSS 3.1 of 8.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the vector contains PR:N, confirming no credentials or user interaction are required. Impact is integrity and availability only - there is no confidentiality exposure - and there is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk is gated by whether the OT management segment is reachable from an untrusted network.
RemediationAI
Patch status: patch available per vendor advisory - the supplied data does not specify an exact fixed firmware version, so administrators must obtain the corrected firmware build for the EKI-1242EIMS/EKI-1242IEIMS from Advantech's security advisory (https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf) rather than assuming V1.06.01 or any inferred build is remediated. Where immediate firmware upgrade is not possible, the most effective compensating control is to block inbound access to TCP port 5058 at every boundary between untrusted or IT networks and the OT management segment, allowing only explicitly enumerated engineering workstations via host-based ACLs or firewall rules; this eliminates the attack path because the vulnerability requires network reachability to that port and nothing else. Note the trade-off: blocking 5058 also disables legitimate remote commissioning and centralized management of these gateways, so pair it with a documented maintenance exception window or a jump host on the management VLAN. Additional hardening includes placing the gateways on an isolated management VLAN with no routing to the corporate network, disabling any WAN/NAT exposure of port 5058, and monitoring for unexpected 5058 sessions, anomalous reboots, factory resets, or firmware-write events as indicators of attempted abuse. Because exploitation yields high integrity and availability impact but no confidentiality impact, integrity-checking gateway configuration and firmware images after any suspected exposure is a sensible detection and recovery step; note that firmware-upgrade functionality is itself reachable through this flaw, so validate firmware signatures obtained out-of-band rather than trusting an on-device update alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the edgserver management service, a device-management protocol listening on TCP port 5058 in Advantech EKI-1242EIMS and EKI-1242IEIMS edge/industrial gateways. The root-cause class is CWE-306 (Missing Authentication for Critical Function): the service accepts and executes management requests without validating any credential, session token, or authorization context, so the protocol's own request grammar becomes the entire attack surface. Because the missing control is authentication rather than a memory-safety or injection bug, exploitation is deterministic and does not depend on heap layout, ASLR, or payload complexity - any crafted request that conforms to the protocol reaches privileged device-management routines. The exposed operations (network reconfiguration, reboot, reset, firmware upgrade) map directly to the assessed high integrity and high availability impact with no confidentiality impact (VC:N), consistent with an attacker manipulating device state and loading untrusted firmware rather than exfiltrating data. Advantech's CPE records mark the entire version range for both the EKI-1242IEIMS and EKI-1242EIMS models as affected, with firmware V1.06.01 specifically named in the Nozomi Networks Labs finding. This is characteristic OT/edge-gateway attack surface: the management plane is intended for commissioning and maintenance, frequently co-resident on the same Layer-2/Layer-3 segment as the operational network, and rarely protected by authentication or transport encryption at the protocol level.
Know when Eki 1242Ieims gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated access to port 5058 (AV:N/AC:L/PR:N/UI:N); invoking reconfig/firmware functions destroys integrity and availability (I:H/A:H) but exposes no data (C:N).
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
DescriptionCVE.org
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.
Executive ViewAI
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 are affected by a high-severity, unauthenticated remote attack that can alter network configurations, cause reboots or resets, and push unauthorized firmware updates. This threatens the integrity and availability of operational technology networks, potentially disrupting industrial processes and causing costly downtime or safety incidents. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, so leadership should prioritize exposure reduction because the risk is gated by whether the management interface is reachable from untrusted networks.
Interim mitigations include network segmentation to isolate the management interface, firewall rules blocking TCP port 5058 from untrusted networks, restricting access to a dedicated management VLAN, monitoring for unauthorized access attempts, and disabling the edgserver service if not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Eki 1242Ieims
View allUnauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gat
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industria
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices runn
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01)
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industr
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIM
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI
Exploit-DB