CVE-2026-73173: Advantech EKI-1242EIMS Auth Bypass Flaw

CVE-2026-73173 Overview

CVE-2026-73173 is a missing authentication vulnerability [CWE-306] in the edgserver management protocol of the Advantech EKI-1242EIMS industrial protocol gateway. Firmware version V1.06.01 exposes critical device-management functions on TCP port 5058 without authentication. A remote unauthenticated attacker can invoke network reconfiguration, reboot, factory reset, and firmware upgrade operations by sending crafted requests. Nozomi Networks Labs identified and disclosed the flaw. The issue affects the integrity and availability of the device, enabling adversaries to disrupt operational technology (OT) environments or persist through malicious firmware.

Critical Impact
Unauthenticated attackers reachable on TCP/5058 can reconfigure networking, reboot, factory-reset, or push firmware to affected Advantech EKI-1242EIMS gateways.

Affected Products

Advantech EKI-1242EIMS industrial protocol gateway
Firmware version V1.06.01
Devices exposing the edgserver management service on TCP port 5058

Discovery Timeline

2026-09-16 - CVE-2026-73173 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database
Vulnerability identified and reported by Nozomi Networks Labs

Technical Details for CVE-2026-73173

Vulnerability Analysis

The Advantech EKI-1242EIMS gateway runs a proprietary management service, referred to as edgserver, that listens on TCP port 5058. This service accepts command messages that trigger high-impact administrative operations. The service does not require the caller to authenticate before executing these commands. Any host with network reachability to the device can issue management requests and receive a valid response. In industrial deployments, these gateways bridge serial and Ethernet-based OT protocols, so unauthenticated administrative access translates directly into control-plane compromise.

Root Cause

The root cause is a missing authentication check on a security-critical function [CWE-306]. The edgserver protocol handler dispatches management opcodes without validating the identity or authorization of the sender. Design decisions typical of legacy field devices, such as trusting the local network segment and prioritizing operational simplicity, leave device-management functions exposed to any reachable peer.

Attack Vector

Exploitation requires only network reachability to TCP port 5058 on the target gateway. An attacker crafts a request that maps to one of the management opcodes exposed by edgserver and transmits it directly to the device. Successful requests can:

Rewrite IP address, gateway, and routing configuration
Trigger a device reboot, interrupting downstream serial or fieldbus traffic
Perform a factory reset that erases the current configuration
Upload attacker-supplied firmware, enabling persistent implant deployment

No user interaction is required and no credentials are needed. Refer to the Nozomi Networks CVE-2026-73173 Advisory and the Advantech Security Advisory EKI-1242IEIMS for protocol-level details.

Detection Methods for CVE-2026-73173

Indicators of Compromise

Unexpected inbound TCP sessions to port 5058 on EKI-1242EIMS gateways from hosts outside the OT engineering workstation range
Unscheduled device reboots, configuration changes, or factory-reset events recorded in device or upstream switch logs
Firmware version strings that do not match the approved gold image after a management session
Sudden loss of downstream serial/Modbus polling correlated with a management-plane connection

Detection Strategies

Deploy passive OT network monitoring to flag any TCP/5058 traffic that does not originate from an authorized management host
Alert on firmware upgrade transactions or configuration writes issued outside approved change windows
Baseline gateway configuration hashes and alert on deviations from the known-good state

Monitoring Recommendations

Forward gateway syslog and upstream switch port statistics to a centralized SIEM for correlation of reboot and link-flap events
Track SNMP sysUpTime on each EKI-1242EIMS device and alert on unexpected resets
Review firewall and ACL hit counters for TCP/5058 attempts across VLAN boundaries

How to Mitigate CVE-2026-73173

Immediate Actions Required

Inventory all Advantech EKI-1242EIMS devices and confirm firmware version; isolate any running V1.06.01
Restrict TCP/5058 to a dedicated engineering workstation subnet using upstream firewall or switch ACLs
Disconnect affected gateways from any network segment reachable from IT, DMZ, or remote-access infrastructure
Monitor for unauthorized management traffic and firmware or configuration changes until a patch is applied

Patch Information

Advantech has published guidance for the EKI-1242IEIMS product family. Review the Advantech Security Advisory EKI-1242IEIMS for fixed firmware availability and installation instructions. Apply the vendor-supplied firmware update on all impacted devices and validate the version string post-upgrade.

Workarounds

Place affected gateways behind a segmentation firewall that denies TCP/5058 by default and permits only allow-listed engineering hosts
Terminate management access over a jump host with strong authentication and full session logging
Disable or physically disconnect unused Ethernet interfaces on the gateway to reduce exposure
Schedule frequent configuration and firmware integrity verification against a signed baseline

bash

# Example upstream ACL restricting edgserver (TCP/5058) to an engineering workstation subnet
# Replace interface, source, and destination values with your environment specifics
access-list 150 permit tcp 10.10.20.0 0.0.0.255 host 10.50.4.12 eq 5058
access-list 150 deny   tcp any host 10.50.4.12 eq 5058 log
access-list 150 permit ip any any

interface GigabitEthernet0/1
 ip access-group 150 in