CVE-2026-73175: Advantech EKI-1242EIMS DOS Vulnerability

CVE-2026-73175 Overview

CVE-2026-73175 is an uncontrolled resource consumption vulnerability [CWE-400] in the Open Platform Communications Unified Architecture (OPC UA) gateway component of the Advantech EKI-1242EIMS industrial protocol gateway running firmware version V1.06.01. The flaw was identified by Nozomi Networks Labs. An adjacent unauthenticated attacker can exhaust the OPC UA server session pool by repeatedly opening anonymous sessions. Once the pool is depleted, legitimate OPC UA clients can no longer connect, resulting in a complete denial of service on the industrial gateway.

Critical Impact
Adjacent unauthenticated attackers can trigger a full denial of service against the OPC UA gateway, disrupting industrial data exchange between field devices and supervisory systems.

Affected Products

Advantech EKI-1242EIMS industrial protocol gateway
Firmware version V1.06.01
OPC UA gateway component (server session handling)

Discovery Timeline

2026-09-16 - CVE-2026-73175 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73175

Vulnerability Analysis

The Advantech EKI-1242EIMS exposes an OPC UA server that mediates communication between industrial field devices and OPC UA clients. The server allocates sessions from a bounded internal pool when clients initiate connections. The implementation does not enforce per-source limits or throttling on anonymous session creation. An attacker on an adjacent network segment can repeatedly issue OPC UA CreateSession requests using anonymous authentication until the pool is fully occupied. Once exhausted, the server rejects further connection attempts from legitimate clients, halting industrial telemetry and control data flows that depend on the gateway.

Root Cause

The root cause is the absence of resource governance around anonymous session creation in the OPC UA gateway. The service accepts unauthenticated session establishment without applying quotas, rate limits, or timeout-based eviction sufficient to sustain availability under abuse. This aligns with CWE-400: Uncontrolled Resource Consumption.

Attack Vector

Exploitation requires adjacent network access to the OPC UA endpoint exposed by the EKI-1242EIMS. No authentication, user interaction, or privileges are needed. The attacker opens multiple anonymous OPC UA sessions in succession and keeps them allocated. Because OPC UA gateways commonly sit inside operational technology (OT) networks with limited segmentation, an attacker who gains a foothold on the adjacent subnet can trigger the denial-of-service condition with minimal tooling using standard OPC UA client libraries.

See the Nozomi Networks CVE-2026-73175 Advisory and the Advantech Security Advisory EKI-1242IEIMS for vendor-supplied technical details.

Detection Methods for CVE-2026-73175

Indicators of Compromise

Bursts of OPC UA CreateSession requests from a single adjacent host targeting the EKI-1242EIMS gateway
Elevated counts of concurrent anonymous OPC UA sessions on the gateway
Legitimate OPC UA clients receiving session-establishment rejections or timeouts
Gateway logs showing session pool saturation or connection refusals

Detection Strategies

Baseline the normal number of concurrent OPC UA sessions per client and alert on statistical deviations
Inspect OPC UA traffic for repeated CreateSession and ActivateSession messages using anonymous tokens from a single source
Correlate industrial process telemetry gaps with spikes in OPC UA connection attempts to the gateway

Monitoring Recommendations

Forward gateway and OT network telemetry into a centralized analytics platform for cross-source correlation
Enable protocol-aware monitoring on the OT segment hosting the EKI-1242EIMS
Track availability metrics for OPC UA clients that depend on the gateway and alert on connection loss

How to Mitigate CVE-2026-73175

Immediate Actions Required

Inventory all Advantech EKI-1242EIMS devices and confirm which run firmware V1.06.01
Restrict network reachability to the OPC UA port so only authorized clients on the OT segment can connect
Monitor the affected gateways for abnormal session-establishment patterns
Review the Advantech Security Advisory EKI-1242IEIMS for vendor remediation guidance

Patch Information

Advantech has published a security advisory for the EKI-1242IEIMS covering this issue. Consult the vendor advisory for the fixed firmware version and update procedure before deployment in production OT environments.

Workarounds

Place the gateway behind a firewall or industrial DMZ and permit OPC UA traffic only from an allowlist of client IP addresses
Disable anonymous OPC UA session establishment where the gateway configuration permits, and require authenticated sessions
Segment the OT network to prevent lateral access from IT or guest networks to the OPC UA endpoint
Deploy protocol-aware intrusion detection on the OT segment to identify session-exhaustion patterns

bash

# Example: restrict access to the OPC UA port (default 4840) to authorized clients
iptables -A INPUT -p tcp --dport 4840 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP