EUVD-2026-80700
GHSA-pxh8-mw2j-c73g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web interface with low complexity, but requires administrator privileges (PR:H); unsigned firmware install yields full persistent compromise, so C/I/A all High, scope unchanged.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
2DescriptionCVE.org
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.
AnalysisAI
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 can upload firmware images that the device accepts without any cryptographic signature or certificate verification, resulting in full, persistent compromise of the platform (CWE-345; CVSS 4.0 base 8.6). The risk is genuine but access-gated: the attacker must already hold administrator-level credentials for the management interface (PR:H), so this CVE does not by itself provide a pre-authentication or privilege-escalation path, but the resulting ability to replace device firmware gives durable control over an industrial edge device that may sit on an OT/IT boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated administrator-level session on the EKI-1242EIMS/EKI-1242IEIMS web management interface (PR:H) and network reachability to that interface (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fixed firmware version is confirmed in the available data; patch status is therefore "patch available per vendor advisory" only in the sense that Advantech has published a vendor security advisory, and the exact remediated firmware build must be taken from that advisory (https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf) or from Nozomi Networks (https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73177) before upgrading EKI-1242EIMS/EKI-1242IEIMS units. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Advantech EKI-1242EIMS and EKI-1242IEIMS device and confirm which units are running firmware V1.06.01, then determine whether each web management interface is reachable from untrusted networks; immediately restrict that reachability to a dedicated management VLAN or allowlisted jump host and rotate administrator credentials on any exposed unit. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eki 1242Ieims
View allUnauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gat
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industria
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIM
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industr
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices runn
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01)
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today