CVE-2026-73170
CVE-2026-73170
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary Lua code on the device via a crafted imported file.
Vulnerability class: RCE (Remote Code Execution)
Weakness classification (CWE)
References
- prodsec@nozominetworks.com (third-party-advisory)
- prodsec@nozominetworks.com (vendor-advisory)