OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-73170

HIGH · CVSS 8.6 EPSS 0.54%

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The Modbus CSV import workflow in Advantech EKI-1242EIMS firmware version V1.06.01 is vulnerable to a code injection flaw, enabling remote authenticated attackers to execute arbitrary Lua code on the device through specially crafted files. This vulnerability poses a significant risk as it could lead to unauthorized control or manipulation of the device's functions. Organizations using this firmware should prioritize patching to mitigate potential exploitation risks.

CVE
CVE-2026-73170
Severity
HIGH
CVSS
8.6
EPSS
0.54%

Original NVD Description

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a crafted imported file.