CVE-2026-73177: Advantech EKI-1242EIMS vulnerability

Published Sep 16, 2026

Updated

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform.

Affected Software

1 affected component

Advantech EKI-1242EIMS=V1.06.01

Event History

Sep 16, 2026

CVE Published

via MITRE·01:03 PM

Data Sourced

via MITRE·01:03 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be authenticated to the web management interface with administrator-level privileges. The issue is exploitable through the firmware upgrade mechanism.

What is the impact of successful exploitation?

An administrator-level attacker can install an arbitrary modified firmware image. This enables full, persistent compromise of the device.

How can I determine whether a device is affected?

The vulnerability was identified in Advantech EKI-1242EIMS firmware version V1.06.01. Review the firmware version installed on EKI-1242EIMS devices and assess whether administrator access to their web management interfaces is appropriately restricted.