Advantech EKI-1242EIMS CVE-2026-73177

Exploitation requires an authenticated administrator-level session on the EKI-1242EIMS/EKI-1242IEIMS web management interface (PR:H) and network reachability to that interface (AV:N). The specific enabling condition is that the firmware upgrade mechanism in firmware V1.06.01 performs NO cryptographic signature or certificate verification on uploaded firmware images, so any admin-supplied image is accepted. Limiting factors: attacker must already hold admin credentials (no privilege escalation or pre-auth path within this CVE itself), and exploitation is bounded to environments where the management interface is reachable by the attacker; no user interaction is needed once admin access exists.

This is a genuine but access-gated risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, 8.6) accurately reflects a firmware-authenticity flaw: an attacker who already holds administrator credentials on the web management interface can flash unsigned, attacker-modified firmware, yielding full persistent platform compromise (all three impact metrics High). The PR:H requirement is the dominant limiter - this is a post-authentication persistence/root-of-trust weakness, not a pre-auth breach. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active or opportunistic exploitation; realistically this is a targeted post-compromise capability (an attacker who has phished/brute-forced admin, or an insider, converting admin access into durable firmware-level implants). Contrast with same-advisory sibling CVE-2026-73172, a pre-auth (PR:N) root RCE at 9.3 - that is a far higher acquisition priority than this authenticated flaw. Prioritize CVE-2026-73177 as a defense-in-depth/root-of-trust fix rather than an emergency, but note that once admin is obtained via any of the sibling web-UI RCEs, this flaw makes eviction extremely difficult. No signals conflict; the vector and description are consistent.

An attacker who has obtained administrator credentials to the EKI-1242EIMS web management interface (via reused/default credentials, phishing, or one of the sibling pre-auth RCEs) uploads a maliciously modified firmware image through the standard upgrade function. Because the device performs no signature or certificate verification, it accepts and installs the tampered image, giving the attacker a persistent, firmware-level implant that survives reboots and factory resets. No public exploit code is identified at time of analysis.