CVE-2026-73177

The Advantech EKI-1242EIMS at firmware version V1.06.01 does not cryptographically verify firmware images during the update process, an insufficient verification of data authenticity flaw (CWE-345) identified by Nozomi Networks Labs. An attacker who is already authenticated as an administrator can upload a modified firmware image through the device's web management interface, and the device installs it without any signature or certificate check. Successful exploitation yields full, persistent compromise of the platform, since the attacker-controlled firmware remains resident on the device. Organizations running the EKI-1242EIMS, typically in industrial and OT deployments, are affected; the requirement for administrator-level credentials means risk is highest where such credentials could be stolen, reused, or abused by insiders. No public proof-of-concept is known, the vulnerability is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Upgrade the EKI-1242EIMS to a fixed firmware release from Advantech as soon as one is published (V1.06.01 is the version confirmed affected; check the vendor advisory for the patched build). Until then, restrict web management access to trusted administrative hosts, segment the device from untrusted networks, and only flash firmware obtained directly from official Advantech sources. Audit administrator credentials and review devices for signs of unauthorized firmware changes.