CVE-2026-73170 Overview
CVE-2026-73170 is a code injection vulnerability [CWE-94] in the Modbus CSV import workflow of the Advantech EKI-1242EIMS industrial protocol gateway running firmware version V1.06.01. Nozomi Networks Labs identified the flaw, which allows a remote authenticated attacker to execute arbitrary Lua code on the device by uploading a crafted CSV file. Successful exploitation grants full compromise of confidentiality, integrity, and availability on the affected industrial device.
Critical Impact
A remote authenticated attacker can execute arbitrary Lua code on the Advantech EKI-1242EIMS gateway, gaining control over Modbus protocol translation in operational technology environments.
Affected Products
- Advantech EKI-1242EIMS firmware version V1.06.01
- Advantech EKI-1242IEIMS Modbus gateway series (per vendor advisory)
- Industrial deployments using the affected Modbus-to-Ethernet/IP protocol gateway
Discovery Timeline
- Vulnerability discovered by Nozomi Networks Labs
- 2026-09-16 - CVE-2026-73170 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-73170
Vulnerability Analysis
The Advantech EKI-1242EIMS is an industrial Modbus gateway that translates Modbus protocol traffic to Ethernet/IP. The device supports importing device configurations through CSV files. The import workflow processes CSV content using the Lua scripting engine embedded in the gateway firmware.
The CSV parsing routine fails to enforce strict separation between data fields and executable Lua constructs. An authenticated attacker with access to the management interface can craft a CSV file whose fields contain Lua code fragments. When the gateway imports the file, the embedded Lua interpreter evaluates the attacker-controlled content in the context of the configuration process.
Execution occurs on the device itself, giving the attacker a foothold inside the industrial network segment where the gateway operates. Because the gateway sits between control systems and field devices, code execution here can alter Modbus register mappings, forward malicious payloads, or disrupt protocol translation.
Root Cause
The root cause is improper control of code generation [CWE-94]. The Modbus CSV import handler concatenates or evaluates user-supplied CSV field content within a Lua execution context without validating, escaping, or sandboxing the input. This design conflates configuration data with executable script.
Attack Vector
Exploitation requires network access to the device management interface and valid authenticated credentials with permission to import configuration files. The attacker uploads a crafted CSV file through the standard Modbus CSV import feature. The device parses the file and executes attacker-supplied Lua code during the import routine. No user interaction on the victim side is required beyond the initial authenticated upload.
Refer to the Nozomi Networks CVE-2026-73170 Advisory and the Advantech Security Advisory EKI-1242IEIMS for vendor technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-73170
Indicators of Compromise
- CSV configuration files uploaded to the EKI-1242EIMS containing Lua keywords such as os.execute, io.popen, loadstring, or require inside field values.
- Unexpected outbound connections originating from the gateway IP address to attacker-controlled hosts.
- Configuration changes on the gateway that do not correlate with authorized change management records.
Detection Strategies
- Inspect HTTP or web management sessions that invoke the Modbus CSV import endpoint and capture the uploaded file contents for offline review.
- Baseline the gateway configuration and alert on unauthorized modifications to Modbus register maps or firmware behavior.
- Correlate authentication events on the management interface with subsequent file import actions to identify anomalous administrative activity.
Monitoring Recommendations
- Log and retain all authenticated administrative sessions to the EKI-1242EIMS management plane.
- Monitor north-south and east-west traffic from the gateway using industrial network monitoring tools capable of parsing Modbus and management protocols.
- Alert on any egress from the gateway to non-approved destinations, since the device should have a limited and static communication profile.
How to Mitigate CVE-2026-73170
Immediate Actions Required
- Restrict access to the EKI-1242EIMS management interface to a dedicated administrative network segment or jump host.
- Rotate credentials for all accounts authorized to perform configuration imports and enforce least privilege on import permissions.
- Audit recent CSV imports and gateway configuration state to identify signs of prior exploitation.
Patch Information
Refer to the Advantech Security Advisory EKI-1242IEIMS for the vendor-supplied firmware update addressing CVE-2026-73170. Apply the fixed firmware version released by Advantech to all deployed EKI-1242EIMS units running firmware V1.06.01 or earlier.
Workarounds
- Disable the Modbus CSV import feature where operationally feasible until the patched firmware is applied.
- Enforce network access control lists that permit management traffic only from specific, authorized engineering workstations.
- Deploy industrial protocol firewalls between the operational network and the gateway to block unauthorized configuration uploads.
# Configuration example: restrict management access to the EKI-1242EIMS
# Replace 10.10.20.5 with the authorized engineering workstation IP
# and 192.168.100.10 with the gateway management IP
iptables -A FORWARD -s 10.10.20.5 -d 192.168.100.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.168.100.10 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
