Advantech EKI-1242EIMS EUVD-2026-80731

Exploitation requires the attacker to already hold high-privilege authenticated access to the EKI-1242EIMS web management interface (PR:H) in order to write malicious script into the Modbus transaction management interface, and the stored payload only executes when a separate administrator subsequently opens the affected management page (UI:P). These two conditions - pre-existing admin access plus victim interaction - are the key limiters; there is no unauthenticated or zero-interaction path. Impact on the vulnerable gateway itself is limited to Low confidentiality/integrity, with the more serious consequences landing in the victim administrator's browser session.

This is a stored/persistent cross-site scripting flaw (CWE-79) in the Modbus transaction management interface of the Advantech EKI-1242EIMS industrial gateway. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H, base 6.3) shows two real limiters that keep this below the critical tier: PR:H means the attacker must already hold high (administrator-level) privileges to reach and write to the transaction interface, and UI:P means a second administrator must actively open the poisoned management page for the payload to fire. The vulnerable-system impact is only Low across confidentiality and integrity; the score is inflated mainly by the generous SC:H/SI:H/SA:H subsequent-system ratings, which treat the victim admin's browser/session as fully compromisable - arguably optimistic for a single injected script. No CISA KEV listing, no public POC, and no EPSS score are present, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate but not urgent finding - the high-privilege precondition and required user interaction make it a targeted post-authentication privilege-consolidation vector rather than a mass-exploitable pre-auth bug. Treat as medium priority, patch on normal OT maintenance cadence.

A remote attacker who already has authenticated administrative access to an EKI-1242EIMS gateway injects a malicious script into a Modbus transaction management field that is persistently stored. When another administrator later opens the affected management page, the script executes in their browser session, letting the attacker hijack that session or perform actions in the victim's context. No public exploit code is identified at time of analysis.