CVE-2026-73170 in EKI-1242EIMS
Summary
by MITRE • 09/16/2026
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a crafted imported file.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified security flaw represents a critical instance of CWE-94, commonly known as Improper Control of Generation of Code or Code Injection, specifically affecting the Modbus CSV import functionality within Advantech EKI-1242EIMS industrial IoT devices running firmware version V1.06.01. This vulnerability arises from insufficient validation and sanitization mechanisms applied to user-supplied input during the processing of Comma-Separated Values files intended for configuration or data ingestion via Modbus protocols. The core technical deficiency lies in the application's failure to strictly enforce type constraints and escape special characters within the CSV fields before they are passed to an underlying Lua scripting engine. Consequently, when a remote authenticated attacker crafts a maliciously formatted CSV file containing embedded Lua code snippets, the system interprets these strings as executable commands rather than static data values. This lack of input validation allows for arbitrary code execution on the device's operating environment, effectively bypassing intended security boundaries and granting the attacker significant control over the industrial network infrastructure managed by this gateway.
From an operational perspective, the exploitation of this vulnerability poses a severe risk to the integrity and availability of critical industrial processes. Since the EKI-1242EIMS serves as a bridge between legacy Modbus devices and higher-level supervisory systems, compromising its firmware execution environment can lead to unauthorized manipulation of physical process variables such as temperature, pressure, or flow rates. An attacker leveraging this code injection flaw could potentially alter device configurations, disrupt communication with connected sensors and actuators, or use the compromised gateway as a pivot point for lateral movement within the industrial control system network. The requirement for authentication does not mitigate the risk significantly in environments where credentials may be weak, shared, or stolen through other vectors such as phishing or credential stuffing attacks. Once authenticated access is achieved, the ability to execute arbitrary Lua code transforms a standard configuration task into a potent attack vector capable of causing physical damage, safety hazards, and prolonged operational downtime.
This vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, particularly those involving local execution or remote command injection through file upload mechanisms. The exploitation path typically involves crafting a specific CSV payload that exploits the parsing logic's inability to distinguish between data literals and executable script fragments. To mitigate this risk, Advantech should promptly release a firmware update that implements strict input validation rules for all fields processed during Modbus CSV imports. This includes enforcing allow-listing of acceptable characters, sanitizing special symbols associated with Lua syntax such as brackets, quotes, and semicolons, and ensuring that any dynamic code evaluation is either disabled entirely or restricted to highly privileged contexts with rigorous sandboxing. Additionally, network segmentation strategies should be employed to restrict access to the management interfaces of these devices, limiting exposure only to authorized administrative workstations. Regular security audits and penetration testing focused on input validation weaknesses in industrial IoT components are essential for maintaining resilience against such injection-based attacks.