Is CVE-2026-73170 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73170 being exploited in the wild.

How severe is CVE-2026-73170?

Informational severity, with a CVSS score of 8.6, published 16 September 2026.

Which products and versions are affected?

Advantech EKI-1242EIMS V1.06.01; Advantech EKI-1242IEIMS V1.06.01.

Is there a fix for CVE-2026-73170?

A patch was published on 2026-09-04: Firmware version 2.00.01 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73170 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73170?

Check whether you run Advantech EKI-1242EIMS or Advantech EKI-1242IEIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73170: Advantech EKI-1242EIMS code injection in Modbus CSV import

CVE-2026-73170 · Severity: info · CVSS 8.6 · Published 2026-09-16

Advantech EKI-1242EIMS is an industrial IoT device used to monitor and control Modbus networks. An authenticated attacker can upload a specially crafted CSV file that executes arbitrary Lua code on the device, potentially compromising operational technology infrastructure and enabling device manipulation or data theft.

Technologies: Advantech EKI-1242EIMS, Advantech EKI-1242IEIMS. Vendors: Advantech.

Quick answers

Is CVE-2026-73170 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73170 being exploited in the wild.
How severe is CVE-2026-73170?: Informational severity, with a CVSS score of 8.6, published 16 September 2026.
Which products and versions are affected?: Advantech EKI-1242EIMS V1.06.01; Advantech EKI-1242IEIMS V1.06.01.
Is there a fix for CVE-2026-73170?: A patch was published on 2026-09-04: Firmware version 2.00.01 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73170 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73170?: Check whether you run Advantech EKI-1242EIMS or Advantech EKI-1242IEIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a code injection flaw (CWE-94) in the Modbus CSV import functionality of Advantech EKI-1242EIMS firmware version V1.06.01. The device improperly validates or sanitizes CSV input when importing Modbus configurations, allowing an attacker to embed and execute arbitrary Lua code. The attack requires network access and valid authentication credentials. An authenticated remote attacker can leverage this to execute arbitrary Lua code with device-level privileges, potentially compromising the integrity and availability of the device and connected industrial systems. The vendor has released firmware version 2.00.01 that fixes this issue.

Affected products

Advantech EKI-1242EIMS V1.06.01
Advantech EKI-1242IEIMS V1.06.01

Timeline

2026-09-16: disclosed
2026-09-04: patched: Firmware version 2.00.01 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.