Advantech EKI-1242EIMS Firmware Upgrade Endpoint Accepts Images Without Signature Verification, Allowing Authenticated Administrators to Achieve Persistent Full Compromise

Last refreshed2026-09-29

Status: NEW | Advisory ID: CVE-2026-73177

Key Details

CVE	CVE-2026-73177
CVSS Score / Version	8.6 (High) / CVSS v4.0
Updated	2026-09-17
Classified as	CWE-345 (Insufficient Verification of Data Authenticity)

What to Know

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without performing any cryptographic signature or certificate verification. An authenticated administrator-level attacker can install arbitrary modified firmware on the device, enabling full persistent compromise of the platform. (NVD)

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-73177
CVE	https://www.cve.org/CVERecord?id=CVE-2026-73177

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-73177

CVE

https://www.cve.org/CVERecord?id=CVE-2026-73177

Advantech EKI-1242EIMS Firmware Upgrade Endpoint Accepts Images Without Signature Verification, Allowing Authenticated Administrators to Achieve Persistent Full Compromise

Key Details

What to Know

References

About