CVE-2026-73175 in EKI-1242IEIMS
Summary
by MITRE • 09/16/2026
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust the server session pool and cause a complete denial of service to all legitimate OPC UA clients by opening multiple anonymous sessions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as CWE-400, Uncontrolled Resource Consumption, resides within the OPC Unified Architecture gateway component of Advantech EKI-1242EIMS industrial IoT devices running firmware version V1.06.01. This flaw specifically impacts the session management logic that handles incoming connection requests from clients seeking to interact with the device's operational technology systems. The core technical deficiency lies in the insufficient validation and rate-limiting mechanisms applied when processing anonymous authentication attempts. By exploiting this weakness, an attacker positioned on the adjacent network segment can initiate a high volume of simultaneous OPC UA sessions without providing valid credentials. This behavior directly triggers resource exhaustion within the server session pool, which is typically limited by hardware constraints or configured software limits designed to maintain stability under normal operational loads rather than malicious stress conditions.
From an operational perspective, this vulnerability enables a severe denial-of-service attack against critical industrial infrastructure. When the attacker opens multiple anonymous sessions in rapid succession, the device's finite resources are consumed until no further connections can be established. This results in a complete inability for legitimate OPC UA clients to communicate with the gateway, effectively severing visibility and control over connected sensors, actuators, or other OT assets that rely on this communication channel. In an industrial environment where real-time data exchange is critical for process monitoring and safety interlocks, such a disruption can lead to significant operational downtime, potential production losses, and in worst-case scenarios, unsafe operating conditions if fail-safe mechanisms are not independently triggered by the underlying control logic rather than the network layer.
The attack vector aligns with ATT&CK technique T1498, Network Denial of Service, specifically sub-technique T1498.003 which involves flooding a target to exhaust resources. The lack of authentication requirements for these sessions exacerbates the risk, as it allows any device on the local network segment to participate in the attack without needing prior access credentials or complex exploitation steps. This simplicity makes the vulnerability particularly dangerous in environments where network segmentation is not strictly enforced between IT and OT networks, allowing adversaries with limited initial access to cause disproportionate damage to critical infrastructure availability.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Advantech has released firmware updates that address this resource consumption flaw by implementing stricter limits on concurrent anonymous sessions or requiring authentication for session establishment. Organizations operating the EKI-1242EIMS device must apply these patches immediately to restore secure operation. In addition to patching, network-level controls should be implemented to restrict OPC UA traffic (typically port 4840) to only authorized IP addresses using firewalls or access control lists. This limits the attack surface by ensuring that even if a vulnerability exists in future firmware versions, unauthenticated hosts cannot reach the vulnerable service. Furthermore, deploying intrusion detection systems configured to detect abnormal spikes in connection attempts can provide early warning of such resource exhaustion attacks before they result in complete service disruption.