# CVE-2026-73170: Advantech EKI-1242EIMS code injection in Modbus CSV import

Source: https://junglewise.ai/threats/cve-2026-73170-advantech-eki-1242eims-code-injection-in-modbus-csv-import  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73170 · Severity: info · CVSS 8.6 · Published 2026-09-16

Advantech EKI-1242EIMS is an industrial IoT device used to monitor and control Modbus networks. An authenticated attacker can upload a specially crafted CSV file that executes arbitrary Lua code on the device, potentially compromising operational technology infrastructure and enabling device manipulation or data theft.

Technologies: [Advantech EKI-1242EIMS](https://junglewise.ai/threats/technologies/eki-1242eims), [Advantech EKI-1242IEIMS](https://junglewise.ai/threats/technologies/eki-1242ieims). Vendors: [Advantech](https://junglewise.ai/threats/vendors/advantech).

## Quick answers

**Is CVE-2026-73170 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73170 being exploited in the wild.

**How severe is CVE-2026-73170?** Informational severity, with a CVSS score of 8.6, published 16 September 2026.

**Which products and versions are affected?** Advantech EKI-1242EIMS V1.06.01; Advantech EKI-1242IEIMS V1.06.01.

**Is there a fix for CVE-2026-73170?** A patch was published on 2026-09-04: Firmware version 2.00.01 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73170 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73170?** Check whether you run Advantech EKI-1242EIMS or Advantech EKI-1242IEIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw (CWE-94) in the Modbus CSV import functionality of Advantech EKI-1242EIMS firmware version V1.06.01. The device improperly validates or sanitizes CSV input when importing Modbus configurations, allowing an attacker to embed and execute arbitrary Lua code. The attack requires network access and valid authentication credentials. An authenticated remote attacker can leverage this to execute arbitrary Lua code with device-level privileges, potentially compromising the integrity and availability of the device and connected industrial systems. The vendor has released firmware version 2.00.01 that fixes this issue.

## Affected products

- Advantech EKI-1242EIMS V1.06.01
- Advantech EKI-1242IEIMS V1.06.01

## Timeline

- 2026-09-16: disclosed
- 2026-09-04: patched: Firmware version 2.00.01 released

## References

- [https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf](https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf)
- [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73170](https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73170)

## Related threats

- [Advantech EKI-1242EIMS firmware signature verification bypass](https://junglewise.ai/threats/cve-2026-73177-advantech-eki-1242eims-firmware-signature-verification-bypass)
- [Advantech EKI-1242IEIMS OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-73176-advantech-eki-1242ieims-os-command-injection-in-web-management)
- [Advantech EKI-1242 denial of service in OPC UA gateway](https://junglewise.ai/threats/cve-2026-73175-advantech-eki-1242-denial-of-service-in-opc-ua-gateway)
- [Advantech EKI-1242 cleartext transmission of sensitive information](https://junglewise.ai/threats/cve-2026-73174-advantech-eki-1242-cleartext-transmission-of-sensitive)
- [Advantech EKI-1242IEIMS missing authentication in management protocol](https://junglewise.ai/threats/cve-2026-73173-advantech-eki-1242ieims-missing-authentication-in-management)