Is CVE-2026-73175 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73175 being exploited in the wild.

How severe is CVE-2026-73175?

Informational severity, with a CVSS score of 7.1, published 16 September 2026.

Which products and versions are affected?

Advantech EKI-1242EIMS V1.06.01; Advantech EKI-1242IEIMS V1.06.01.

Is there a fix for CVE-2026-73175?

A patch was published on 2026-09-04: Advantech security advisory issued; firmware version 2.00.01 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73175 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-73175?

Check whether you run Advantech EKI-1242EIMS or Advantech EKI-1242IEIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73175: Advantech EKI-1242 denial of service in OPC UA gateway

CVE-2026-73175 · Severity: info · CVSS 7.1 · Published 2026-09-16

Advantech EKI-1242 industrial gateway devices contain a vulnerability in their OPC UA (a widely-used industrial automation protocol) component that allows an adjacent attacker to exhaust server resources by opening many anonymous sessions. An attacker can exploit this to completely block all legitimate OPC UA clients from connecting, disrupting critical industrial operations and control systems that depend on this gateway.

Technologies: Advantech EKI-1242EIMS, Advantech EKI-1242IEIMS. Vendors: Advantech.

Quick answers

Is CVE-2026-73175 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73175 being exploited in the wild.
How severe is CVE-2026-73175?: Informational severity, with a CVSS score of 7.1, published 16 September 2026.
Which products and versions are affected?: Advantech EKI-1242EIMS V1.06.01; Advantech EKI-1242IEIMS V1.06.01.
Is there a fix for CVE-2026-73175?: A patch was published on 2026-09-04: Advantech security advisory issued; firmware version 2.00.01 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73175 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-73175?: Check whether you run Advantech EKI-1242EIMS or Advantech EKI-1242IEIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The OPC UA gateway component in the Advantech EKI-1242 series does not enforce proper session limits or authentication controls on anonymous session creation, leading to an uncontrolled resource consumption vulnerability (CWE-400). An adjacent, unauthenticated attacker can open multiple anonymous sessions to exhaust the server's session pool, preventing legitimate OPC UA clients from establishing connections. The attack requires network adjacency (e.g., on the same subnet) but no authentication or user interaction. This results in a complete denial of service to all OPC UA functionality. The vendor released firmware version 2.00.01 to address this issue.

Affected products

Advantech EKI-1242EIMS V1.06.01
Advantech EKI-1242IEIMS V1.06.01

Timeline

2026-09-16: disclosed: CVE-2026-73175 published by Nozomi Networks Labs
2026-09-04: patched: Advantech security advisory issued; firmware version 2.00.01 available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.