CWE-73 Path Traversal in Advantech EKI-1242EIMS V1.06.01 via Web Upload
CVE-2026-73171 Published on September 16, 2026
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a crafted backup archive through the web management interface.
Vulnerability Analysis
CVE-2026-73171 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
External Control of File Name or Path
The software allows user input to control or influence paths or file names that are used in filesystem operations.
Affected Versions
Advantech EKI-1242IEIMS:- Before and including 1.06.01 is affected.
- Before and including 1.06.01 is affected.