# CVE-2026-73169: Advantech EKI-1242EIMS stored cross-site scripting in Modbus interface

Source: https://junglewise.ai/threats/cve-2026-73169-advantech-eki-1242eims-stored-cross-site-scripting-in-modbus  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73169 · Severity: info · CVSS 6.3 · Published 2026-09-16

Advantech EKI-1242EIMS is an industrial Ethernet gateway used in operational technology networks to manage Modbus connections. A stored cross-site scripting (XSS) vulnerability in its web-based management interface allows an authenticated administrator to inject malicious scripts that will execute in the browsers of other administrators accessing the Modbus transaction management page, potentially leading to credential theft, account compromise, or lateral movement within the industrial network.

Technologies: [Advantech EKI-1242EIMS](https://junglewise.ai/threats/technologies/eki-1242eims). Vendors: [Advantech](https://junglewise.ai/threats/vendors/advantech).

## Quick answers

**Is CVE-2026-73169 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73169 being exploited in the wild.

**How severe is CVE-2026-73169?** Informational severity, with a CVSS score of 6.3, published 16 September 2026.

**Which products and versions are affected?** Advantech EKI-1242EIMS V1.06.01.

**Is there a fix for CVE-2026-73169?** A patch was published on 2026: Firmware version 2.00.01 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73169 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73169?** Check whether you run Advantech EKI-1242EIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a CWE-79 stored cross-site scripting (XSS) vulnerability in the Modbus transaction management interface component of Advantech EKI-1242EIMS firmware version V1.06.01. The vulnerability allows an authenticated attacker with high privileges to inject malicious script content that persists in the application and executes in the browser of any administrator who subsequently opens the affected management page. Attack preconditions include valid administrative authentication and user interaction (victim must open the affected page). The vulnerability was patched in firmware version 2.00.01 as per the vendor's security advisory.

## Affected products

- Advantech EKI-1242EIMS V1.06.01

## Timeline

- 2026-09-16: disclosed: CVE-2026-73169 published
- 2026: patched: Firmware version 2.00.01 available

## References

- [https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf](https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf)
- [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73169](https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73169)

## Related threats

- [Advantech EKI-1242EIMS firmware signature verification bypass](https://junglewise.ai/threats/cve-2026-73177-advantech-eki-1242eims-firmware-signature-verification-bypass)
- [Advantech EKI-1242IEIMS OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-73176-advantech-eki-1242ieims-os-command-injection-in-web-management)
- [Advantech EKI-1242 denial of service in OPC UA gateway](https://junglewise.ai/threats/cve-2026-73175-advantech-eki-1242-denial-of-service-in-opc-ua-gateway)
- [Advantech EKI-1242 cleartext transmission of sensitive information](https://junglewise.ai/threats/cve-2026-73174-advantech-eki-1242-cleartext-transmission-of-sensitive)
- [Advantech EKI-1242IEIMS missing authentication in management protocol](https://junglewise.ai/threats/cve-2026-73173-advantech-eki-1242ieims-missing-authentication-in-management)