EUVD-2026-80726
GHSA-xm69-j9rc-98cx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network-adjacent position on OT segment
-
ExploitPassively capture edgserver management traffic
-
ExecutionParse cleartext protocol frames
-
ImpactRecover device identity and network metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V12 - Secure Communication Transport encryption
|
| Exploitation Conditions | Requires the attacker to occupy a network-adjacent position (AV:A) - same broadcast/physical segment as the EKI-1242EIMS/EKI-1242IEIMS gateway - from which they can passively observe the edgserver management protocol traffic. No authentication, no user interaction, and no non-default configuration are needed because the management protocol transmits sensitive identity and network metadata in cleartext by design. The primary limiting factors are the adjacency requirement (not routable/remote) and that only confidentiality is affected: the observer recovers metadata but cannot, by passive interception alone, alter or disrupt the device. |
| Impact | This is a genuinely lower-priority issue than its 8.7 CVSS 4.0 score suggests. The vector (AV:A/AC:L/PR:N/UI:N) correctly captures that exploitation requires only network-adjacent positioning and no authentication or user interaction, but the impact metrics VC:H/VI:H/VA:H appear MISCALIBRATED: the description defines a CWE-319 passive-eavesdropping flaw where an observer merely intercepts cleartext management traffic to recover device identity and network metadata. A passive observer cannot modify data (VI:H) or deny service (VA:H) through interception alone - this is a confidentiality-only exposure, so the true severity is closer to medium. No EPSS score, no CISA KEV listing, and no public POC are present, so there is no signal of active exploitation; combined with the adjacency requirement (attacker must already be on the same L2/physical segment as the OT gateway) and the metadata-only disclosure, real-world risk is modest and situational. Treat as a hardening/defense-in-depth item, not an emergency patch. VERIFY the VI/VA metrics with the vendor - they are inconsistent with a passive interception primitive. |
| Exploit ScenarioDerived | An attacker with a foothold on the same local/OT network segment as an Advantech EKI-1242EIMS gateway passively sniffs the unencrypted edgserver management protocol and harvests device identity and network topology metadata in cleartext. No credentials, exploit code, or victim interaction are needed, but the attacker must already be network-adjacent. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 allows any observer positioned on the same network segment to recover sensitive device identity and network metadata as it traverses the wire. The vulnerability is unauthenticated and requires no user interaction (CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N), but our independent assessment scopes the real-world impact to confidentiality only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) because a purely passive observer cannot alter or disrupt device behavior - the CVSS 4.0 base score of 8.7 reflects the vector's asserted high integrity and availability impact, which is not supported by the exploitation conditions. No public exploit code and no CISA KEV listing were identified at time of analysis, and the primary limiting factor is the requirement for network adjacency (the protocol is not remotely routable).
RemediationAI
No vendor-released patch version is specified in the provided intelligence - the Advantech advisory (https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf) and the Nozomi Networks advisory (https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73174) should be consulted directly to confirm whether firmware later than V1.06.01 addresses the cleartext transmission, and that fix should be applied when confirmed. Because the defect is a lack of encryption in the edgserver protocol itself, the most reliable compensating control is to stop letting the protocol cross untrusted Layer 2 segments: place EKI-1242EIMS/EKI-1242IEIMS management interfaces on a dedicated, aggressively filtered management VLAN, with the trade-off that misconfigured VLAN or trunk settings can silently break management access. Where the edgserver traffic cannot be isolated, tunnel it through an encrypting underlay (e.g., IPsec or an equivalent encrypted tunnel between management hosts and the device) so a passive observer sees only ciphertext - with the trade-off of added latency, key management overhead, and possible incompatibility with proprietary discovery functions. Administrators should also disable unused management services and any cleartext discovery features that are not operationally required, restrict which switch ports can reach the management interface, and audit for untrusted devices, mirror/SPAN ports, or rogue taps on the management segment, since detection of the passive listening itself is generally not feasible from the device. None of these mitigations removes the root cause - they only reduce the adjacency and observability the attacker needs, so migration to a firmware release with an encrypted management channel remains the durable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-319 (Cleartext Transmission of Sensitive Information): the edgserver management protocol implemented in Advantech EKI-1242EIMS/EKI-1242IEIMS firmware V1.06.01 exchanges management data without any transport-layer encryption or integrity protection, so identity strings and network metadata are exposed verbatim to anything that can see the frames. The affected CPE entries are cpe:2.3:a:advantech:eki-1242eims:*:*:*:*:*:*:*:* and cpe:2.3:a:advantech:eki-1242ieims:*:*:*:*:*:*:*:*, identifying these industrial networking devices across the listed firmware generations. Exploitation is a listening problem rather than an injection problem: the attacker needs only to occupy the same broadcast domain or physical segment (AV:A) and capture management traffic passively - no credentials, no privileged position on the device, and no non-default configuration are required, because the cleartext exposure is by design. The vulnerability class matters in OT/industrial deployments where span ports, mirrored uplinks, or flat VLANs commonly place an attacker one Layer-2 hop from management traffic. Notably, the vendor's CVSS 4.0 vector asserts VI:H/VA:H/SA:N, whereas the independent assessment finds only a confidentiality impact (S:U/C:H/I:N/A:N); this analysis follows the independent assessment, since passive interception alone provides no path to modifying device state or causing denial of service. Nozomi Networks Labs is credited with discovery, and the reported tags (Information Disclosure) align with the confidentiality-only framing.
Know when Eki 1242Ieims gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Passive adjacent interception of cleartext management traffic yields confidentiality loss only (C:H); a passive observer cannot modify or deny, so I:N/A:N, and AV:A reflects same-segment adjacency.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
DescriptionCVE.org
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata in cleartext.
Executive ViewAI
Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 expose sensitive management and network metadata to any unauthenticated observer on the same network segment, creating a confidentiality risk for industrial and edge deployments. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, though the network-adjacency requirement limits exposure to shared or poorly segmented networks. Leadership should care because these devices often sit in flat operational technology environments where metadata leakage can enable reconnaissance and lateral movement planning.
No vendor-released patch identified at time of analysis; isolate affected Advantech EKI-1242EIMS and EKI-1242IEIMS devices on dedicated management VLANs, restrict access via firewall/ACL to trusted admin hosts, disable edgserver where possible, route management through encrypted VPN or jump host, and monitor for unauthorized same-segment observers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Eki 1242Ieims
View allUnauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gat
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industria
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices runn
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01)
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industr
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIM
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI
Exploit-DB