EUVD-2026-80724
GHSA-mvv7-vr4g-xvmv
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent unauthenticated session flood with low complexity and no interaction; impact is purely availability (session-pool exhaustion), so C:N/I:N/A:H and S:U.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
2DescriptionCVE.org
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server session pool and cause a complete denial of service to all legitimate OPC UA clients by opening multiple anonymous sessions.
AnalysisAI
Session pool exhaustion in the OPC UA gateway of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial switches running firmware V1.06.01 lets an unauthenticated attacker on an adjacent network segment open multiple anonymous OPC UA sessions and consume the entire server session pool, causing a complete denial of service for all legitimate OPC UA clients. The impact is availability-only (no data read or modified, other device functions unaffected) and is bounded by the adjacency requirement plus the need for the OPC UA gateway to be enabled and to accept anonymous sessions, matching the reported CVSS 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) and the independently assessed CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the OPC UA gateway component to be enabled and reachable, and the OPC UA server must permit anonymous sessions (the description explicitly states the attacker opens 'multiple anonymous sessions'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded availability risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the firmware fix documented in Advantech's security advisory for EKI-1242IEIMS (and the corresponding EKI-1242EIMS release); the provided data does not name an exact fixed version, so confirm the target build against the advisory at https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf before upgrading, and plan for a service-affecting reboot in a maintenance window. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Advantech EKI-1242EIMS and EKI-1242IEIMS units and identify those running firmware V1.06.01; on each, confirm whether the OPC UA gateway is enabled and whether it accepts anonymous sessions, and where operationally permissible disable anonymous session acceptance or disable the gateway entirely, while restricting adjacent-segment reachability with ACLs or firewall rules so only known OPC UA clients can reach it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eki 1242Ieims
View allUnauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gat
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industria
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIM
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industr
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices runn
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01)
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today