Medium severity · published Sep 16, 2026
CVE-2026-73169
Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management…
6.3
CVSS
0.5%
EPSS
No
On KEV
Description
Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Modbus transaction management interface of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to store malicious script content that executes in the browser of any administrator who later opens an affected management page.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EK
EKI-1242EIMS · Advantech
through 1.06.01 · source: vendor
EK
EKI-1242IEIMS · Advantech
through 1.06.01 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73169
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73169
advcloudfiles.advantech.com
https://advcloudfiles.advantech.com/cms/5dafee28-ad53-4d07-a328-7896fcc24b6e/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----EKI-1242IEIMS-updated-20260904.pdf
www.nozominetworks.com
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2026-73169
More from EKI-1242EIMS
9.3
CVE-2026-73172
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver management…
8.8
CVE-2026-73173
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware…
8.7
CVE-2026-73174
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware…
8.6
CVE-2026-73177
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware…
8.6
CVE-2026-73176
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface…