# CVE-2026-73177: Advantech EKI-1242EIMS firmware signature verification bypass

Source: https://junglewise.ai/threats/cve-2026-73177-advantech-eki-1242eims-firmware-signature-verification-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73177 · Severity: info · CVSS 8.6 · Published 2026-09-16

The Advantech EKI-1242EIMS industrial network switch accepts firmware updates through its web management interface without verifying that the firmware image is signed or authentic. An authenticated administrator can upload a modified firmware image to completely compromise the device, gaining persistent control and enabling lateral movement into the connected industrial network.

Technologies: [Advantech EKI-1242EIMS](https://junglewise.ai/threats/technologies/eki-1242eims). Vendors: [Advantech](https://junglewise.ai/threats/vendors/advantech).

## Quick answers

**Is CVE-2026-73177 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73177 being exploited in the wild.

**How severe is CVE-2026-73177?** Informational severity, with a CVSS score of 8.6, published 16 September 2026.

**Which products and versions are affected?** Advantech EKI-1242EIMS V1.06.01.

**Is there a fix for CVE-2026-73177?** A patch was published on 2026-09-16: Firmware version 2.00.01 addresses the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73177 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-73177?** Check whether you run Advantech EKI-1242EIMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a CWE-345 (Insufficient Verification of Data Authenticity) flaw in the firmware upgrade mechanism. The device accepts firmware images through the authenticated web management interface without performing cryptographic signature verification or certificate-based validation. An authenticated administrator-level attacker can upload an arbitrary modified firmware image, achieving full persistent compromise of the platform. The vulnerability affects Advantech EKI-1242EIMS in firmware version V1.06.01; a patch is available in firmware version 2.00.01.

## Affected products

- Advantech EKI-1242EIMS V1.06.01

## Timeline

- 2026-09-16: disclosed: CVE-2026-73177 published
- 2026-09-16: patched: Firmware version 2.00.01 addresses the vulnerability

## References

- [https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf](https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf)
- [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73177](https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73177)

## Related threats

- [Advantech EKI-1242IEIMS OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-73176-advantech-eki-1242ieims-os-command-injection-in-web-management)
- [Advantech EKI-1242 denial of service in OPC UA gateway](https://junglewise.ai/threats/cve-2026-73175-advantech-eki-1242-denial-of-service-in-opc-ua-gateway)
- [Advantech EKI-1242 cleartext transmission of sensitive information](https://junglewise.ai/threats/cve-2026-73174-advantech-eki-1242-cleartext-transmission-of-sensitive)
- [Advantech EKI-1242IEIMS missing authentication in management protocol](https://junglewise.ai/threats/cve-2026-73173-advantech-eki-1242ieims-missing-authentication-in-management)
- [Advantech EKI-1242EIMS OS command injection in edgserver management](https://junglewise.ai/threats/cve-2026-73172-advantech-eki-1242eims-os-command-injection-in-edgserver)