Advantech EKI-1242EIMS Backup-Restore Workflow Accepts Crafted Archives That Overwrite Arbitrary Files on the Device Filesystem

Last refreshed2026-09-29

Status: NEW | Advisory ID: CVE-2026-73171

Key Details

CVE	CVE-2026-73171
CVSS Score / Version	8.6 (High) / CVSS v4.0
Updated	2026-09-23
Classified as	CWE-73 (External Control of File Name or Path)

What to Know

Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-73171
CVE	https://www.cve.org/CVERecord?id=CVE-2026-73171

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-73171

CVE

https://www.cve.org/CVERecord?id=CVE-2026-73171

Advantech EKI-1242EIMS Backup-Restore Workflow Accepts Crafted Archives That Overwrite Arbitrary Files on the Device Filesystem

Key Details

What to Know

References

About