CVE-2026-73173 in EKI-1242EIMS
Summary
by MITRE • 09/16/2026
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including network reconfiguration, reboot, reset, and firmware upgrade, by sending crafted requests to TCP port 5058.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as CWE-306 represents a critical failure in access control mechanisms within the Advantech EKI-1242EIMS industrial Ethernet switch. Specifically, the edgserver management protocol operating on TCP port 5058 lacks any form of authentication or authorization checks for sensitive administrative operations. This architectural flaw allows an attacker who can reach the device over the network to execute high-privilege commands without providing valid credentials. The absence of such security controls means that the system treats requests from unauthenticated sources with the same level of trust as those from authorized administrators, fundamentally undermining the integrity and availability of the industrial control environment in which this device operates.
The technical nature of this flaw involves a direct exposure of critical management functions to remote network endpoints without verifying the identity or permissions of the requester. By sending specifically crafted packets to port 5058, an attacker can trigger actions that are typically reserved for system administrators. These actions include reconfiguring network settings, which can alter routing tables and VLAN assignments; rebooting the device, leading to immediate service disruption; performing a factory reset, which erases all custom configurations and potentially exposes default credentials or settings; and initiating firmware upgrades, which could be used to install malicious code if combined with other vulnerabilities. The ability to perform these operations remotely highlights a severe misconfiguration where management interfaces are exposed without adequate security boundaries.
The operational impact of this vulnerability is profound for industrial environments relying on the EKI-1242EIMS switch. An unauthenticated attacker can cause significant downtime by rebooting or resetting the device, disrupting communication between critical assets such as PLCs and SCADA systems. Network reconfiguration capabilities allow an adversary to isolate segments of the network, redirect traffic to malicious hosts for interception, or create loops that degrade performance. Furthermore, the ability to upgrade firmware opens a vector for persistent compromise if an attacker can supply a modified firmware image containing backdoors or malware. This level of control effectively grants full administrative access to any entity with network connectivity to port 5058, turning a standard management interface into a critical attack surface that threatens both operational continuity and data integrity.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Defense Evasion and Impact, specifically those involving the modification of system configurations or disruption of availability through resource exhaustion or service interruption. The lack of authentication is a classic example of CWE-306, which emphasizes that critical functions must be protected by robust identity verification processes. In industrial control systems where physical safety and continuous operation are paramount, such vulnerabilities pose an unacceptable risk because they bypass the fundamental principle of least privilege. Attackers can exploit this flaw to achieve initial access or escalate privileges without needing to crack passwords or steal credentials, making it a high-value target for adversaries seeking quick disruption or footholds in OT networks.
Mitigation strategies must focus on immediate isolation and long-term architectural improvements. Initially, network segmentation should be enforced to restrict access to TCP port 5058 exclusively to trusted management stations using strict firewall rules or VLANs that prevent general user traffic from reaching the device's management interface. If possible, disabling the edgserver protocol entirely when not required for specific operational needs reduces the attack surface significantly. Advantech should be contacted immediately to obtain a patched firmware version that implements proper authentication mechanisms such as username-password pairs, certificate-based mutual TLS, or role-based access control. Until patches are applied and deployed, continuous monitoring of network traffic on port 5058 using intrusion detection systems can help identify malicious activity attempting to exploit this flaw by looking for unusual patterns in management command sequences originating from unauthorized source IPs.