CVE-2026-73173
Quick assessment
Affected
Advantech EKI-1242IEIMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nozomi Networks Labs 在研华 EKI-1242EIMS 固件版本 V1.06.01 的 edgserver 管理协议中发现了一个 CWE-306（关键功能缺少认证）漏洞。该漏洞允许远程未认证的攻击者通过向 TCP 端口 5058 发送构造的请求，调用关键的设备管理功能，包括网络重配置、重启、复位和固件升级。
Possible ATT&CK Techniques 1 AI
T1557.002 · ARP Cache Poisoning
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73173
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Advantech | EKI-1242IEIMS | 0 ~ 1.06.01 | - |
|
| Advantech | EKI-1242EIMS | 0 ~ 1.06.01 | - |
|
II. Public POCs for CVE-2026-73173
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73173
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-73173 (2)
-
🔗 CVE-2026-73173 | Nozomi Networks Labs third-party-advisory
-
Same Patch Batch · Advantech · 2026-09-16 · 15 CVEs total
| CVE-2026-73172 | 9.3 CRITICAL | Advantech EKI-1242EIMS V1.06.01 命令注入漏洞 |
| CVE-2026-73174 | 8.7 HIGH | Advantech EKI-1242EIMS V1.06.01 明文传输敏感信息漏洞 |
| CVE-2026-19535 | 8.6 HIGH | Advantech EKI-1242IEIMS V1.06.01 CSRF漏洞 |
| CVE-2026-73164 | 8.6 HIGH | 研华EKI-1242IEIMS V1.06.01 OS命令注入漏洞 |
| CVE-2026-73163 | 8.6 HIGH | Advantech EKI-1242IEIMS V1.06.01命令注入 |
| CVE-2026-73165 | 8.6 HIGH | Advantech EKI-1242IEIMS V1.06.01 命令注入 |
| CVE-2026-73170 | 8.6 HIGH | Advantech EKI-1242EIMS V1.06.01 代码注入漏洞 |
| CVE-2026-73171 | 8.6 HIGH | Advantech EKI-1242EIMS V1.06.01 备份路径控制漏洞 |
| CVE-2026-73167 | 8.6 HIGH | Advantech EKI-1242IEIMS V1.06.01 操作系统命令注入 |
| CVE-2026-73166 | 8.6 HIGH | Advantech EKI-1242IEIMS V1.06.01 代码注入漏洞 |
| CVE-2026-73176 | 8.6 HIGH | Advantech EKI-1242IEIMS V1.06.01 OS命令注入漏洞 |
| CVE-2026-73177 | 8.6 HIGH | 研华EKI-1242EIMS固件升级机制缺乏完整性验证 |
| CVE-2026-73175 | 7.1 HIGH | Advantech EKI-1242EIMS v1.06.01 资源耗尽致DoS |
| CVE-2026-73169 | 6.3 MEDIUM | Advantech EKI-1242EIMS V1.06.01 存储型XSS |
IV. Related Vulnerabilities
V. Comments for CVE-2026-73173
No comments yet