Threat Intelligence Report — CVE-2026-19535

Executive Summary

CVE-2026-19535 is a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) in the LuCI administrative web interface of the Advantech EKI-1242IEIMS industrial Ethernet switch, specifically affecting firmware version V1.06.01. A remote, unauthenticated attacker can leverage a logged-in administrator's authenticated session to issue unauthorized state-changing requests, granting unauthorized access to privileged device management functions. Because the affected product is an industrial network switch commonly deployed in OT/ICS environments, successful exploitation can disrupt industrial network segmentation and expose critical infrastructure to downstream compromise.

No public proof-of-concept, exploit code, or Nuclei template exists at the time of writing, and no patch has been released by any tracked source. The vulnerability has not been added to CISA KEV and has not been scored by FIRST.org (EPSS unavailable).

Technical Analysis

The vulnerability is classified under CWE-352: Cross-Site Request Forgery (CSRF). CSRF is a class of attack that abuses the trust a web application places in a user's browser. When an authenticated administrator visits a malicious or attacker-controlled web page, that page can silently cause the victim's browser to issue HTTP requests to the LuCI administrative interface. Because the browser automatically attaches any session cookies or authentication tokens associated with the LuCI origin, the application processes the forged request as if it originated legitimately from the authenticated administrator.

The core defect is the absence of an effective anti-CSRF mechanism on state-changing endpoints of the LuCI web interface. In a properly hardened implementation, state-changing operations are protected by unpredictable, per-session tokens (synchronizer token pattern), strict SameSite cookie attributes, and/or origin/referer validation. The NVD description states that the vulnerability "allows a remote unauthenticated attacker to perform unauthorized state-changing requests on behalf of a logged-in administrator, enabling unauthorized access to privileged management functions." This confirms that:

1. No authentication is required of the attacker — the attacker exploits the authenticated session of the victim administrator, not credentials they possess.
2. State-changing requests are forgeable — the LuCI interface does not sufficiently bind requests to the originating user intent (e.g., missing or unvalidated CSRF tokens).
3. Privileged management functions are reachable — the forged operations can reach administrative functionality (e.g., configuration changes, credential or account handling, network settings), not merely read-only views.

LuCI is an OpenWrt-derived web configuration framework, and this class of interface is frequently deployed on embedded industrial networking devices such as the EKI-1242IEIMS. Prior research by Nozomi Networks Labs into LuCI-based interfaces on embedded/industrial devices has demonstrated recurring weaknesses in session handling and request validation on such platforms. The present advisory attributes discovery to Nozomi Networks Labs.

Attack Surface

• Protocol: HTTP/HTTPS administrative web service exposed by the device (LuCI interface).
• Attack vector: The victim administrator must be authenticated into the LuCI interface and must visit (or be induced to visit) attacker-controlled content while that session is active.
• Preconditions: (a) The device's web management interface is reachable by the victim's browser; (b) an administrator is currently logged in; (c) no compensating anti-CSRF control blocks the forged request.
• Device role: The EKI-1242IEIMS is an industrial managed Ethernet switch — management-plane compromise can translate directly into network-segmentation and availability impacts in OT environments.

Note on technical detail: The NVD description does not enumerate specific request paths, parameter names, or token-handling functions. Per accuracy constraints, this report describes the vulnerability class and mechanism and does not fabricate endpoint or parameter names.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the CSRF vulnerability class and the NVD description. No endpoint names, parameter names, or code symbols are asserted because none are provided in the source data.

1) Reconnaissance / Target Identification The attacker identifies internet- or intranet-reachable Advantech EKI-1242IEIMS devices serving the LuCI administrative interface (firmware V1.06.01). Identification can be performed via network scanning for the LuCI web title/interface, banner fingerprinting, or Shodan-style queries against the relevant HTTP title/content signatures. The attacker needs only network reachability to the victim's browser context — direct access to the device is not required for the forged request to succeed.

2) Triggering the Flaw Class (CSRF) The attacker crafts a web page, email body, or other browser-loadable resource that causes the victim's browser to generate an HTTP request to the LuCI interface on the target device. Because the request is generated from the victim's authenticated context and the interface lacks effective request-origin/anti-CSRF validation, the device cannot distinguish it from a legitimate administrator action.

3) Payload / Execution Method (vulnerability-class level) The forged request(s) target state-changing administrative functions on the LuCI interface — the exact functions are unspecified in the advisory but are characterized as "privileged management functions." Execution depends on the administrator being logged in and visiting attacker-controlled content in the same browser session. The attacker does not need to know or steal the administrator's credentials.

4) Post-Exploitation Impact Successful exploitation results in unauthorized state-changing operations performed with administrator privileges. Per the advisory, this "enabl[es] unauthorized access to privileged management functions," which on an industrial switch can include reconfiguration of network behavior or management access, potentially enabling persistence, privilege retention, and follow-on lateral movement or denial of service against the OT network.

Impact Assessment

The advisory assigns no NVD CVSS score. The provisional vector in METADATA (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the described characteristics:

• AV:N (Network) — the attack is carried out remotely over the network via the browser.
• AC:L (Low) — no unusual conditions beyond an authenticated administrator browsing attacker-controlled content.
• PR:N (None) — the attacker needs no privileges or credentials; the victim's session is leveraged.
• UI:R (Required) — the administrator must be induced to load attacker-controlled content while authenticated.
• S:U / C:H / I:H / A:H — compromise of privileged management functions implies high confidentiality, integrity, and availability impact to the device management plane.

Business impact: The EKI-1242IEIMS is an industrial managed switch; compromise of its management plane can undermine network segmentation, enable unauthorized reconfiguration, and — in OT/ICS deployments — introduce availability and safety risk to dependent industrial processes. The affected population is limited to devices running firmware V1.06.01; blast radius is bounded by device fleet size and exposure of the management interface to user-browsable networks. Because exploitation requires an authenticated admin session, the practical risk is highest where administrators browse the general internet from management workstations.

Detection Guidance

Note: Because no public PoC and no explicit endpoints are available, all rules below detect behavioral indicators of CSRF exploitation against a LuCI-style admin interface — cross-origin/forged state-changing requests, anomalous Referer/Origin values on management POSTs, and abuse of authenticated sessions. Tune rule thresholds and field names to your deployment.

Sigma Rule

title: Potential CSRF Exploitation Against LuCI Administrative Interface (CVE-2026-19535)
id: 7b2c9f10-4e3a-4c1b-9d55-csrf1242adv
status: experimental
description: Detects forged state-changing HTTP requests to a LuCI management interface consistent with CWE-352 CSRF abuse (CVE-2026-19535, Advantech EKI-1242IEIMS).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19535
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
  selection_uri:
    cs-uri-stem|contains:
      - '/cgi-bin/luci'
      - '/luci/'
  selection_missing_token:
    cs-uri-query|contains:
      - 'token='
  condition: selection_method and selection_uri and not selection_missing_token
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs(Referer)
  - cs(User-Agent)
falsepositives:
  - Legitimate administrative activity that does not include a CSRF token in the query string
  - Non-LuCI applications matching the URI substring
level: medium
tags:
  - attack.t1190
  - cve.2026-19535
  - cwe.352

YARA Rule

rule CVE_2026_19535_CSRF_LuCI_EKI1242
{
    meta:
        description = "Detects browser-side or embedded payloads referencing forged state-changing requests against the LuCI interface of Advantech EKI-1242IEIMS (CVE-2026-19535, CWE-352)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19535"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $luci1 = "/cgi-bin/luci" ascii nocase
        $luci2 = "LuCI" ascii nocase
        $dev   = "EKI-1242" ascii nocase
        $csrf1 = "csrf" ascii nocase
        $csrf2 = "cross-site request forgery" ascii nocase
        $img   = "img src=" ascii nocase
        $form  = "<form" ascii nocase
        $auto  = "onload=" ascii nocase

    condition:
        (uint16(0) == 0x3C21 or true) and
        (
            (any of ($luci*) and any of ($csrf*)) or
            (any of ($dev) and any of ($luci*)) or
            (any of ($luci*) and 2 of ($img, $form, $auto))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"valtersit.com - Potential CSRF State-Changing Request to LuCI Interface (CVE-2026-19535)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/luci"; nocase; http.uri; content:"!token="; nocase; http.header; content:"Referer"; nocase; pcre:"/Referer\x3a\x20(?!https?:\/\/[^\/]*\/)/iH"; metadata:service http; reference:cve,2026-19535; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-19535; classtype:attempted-admin; sid:202619535; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST"
      and url.path : "/cgi-bin/luci*"
      and not url.query : "*token=*" ]
  [ network where http.response.status_code >= 200
      and http.response.status_code < 300
      and url.path : "/cgi-bin/luci*" ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype="stream:http"
| eval uri=coalesce(uri, url, request_path)
| eval method=coalesce(method, http_method)
| where (method="POST" OR method="PUT")
    AND match(uri, "(?i)/cgi-bin/luci|/luci/")
    AND NOT match(uri, "(?i)token=")
| stats count min(_time) as first_seen max(_time) as last_seen
    values(referer) as referers values(useragent) as useragents
    by src_ip uri
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,csrf,">
  <rule id="100535" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>POST</match>
    <regex>/cgi-bin/luci|/luci/</regex>
    <description>CVE-2026-19535: Potential forged state-changing POST to LuCI administrative interface.</description>
    <group>cve_2026_19535,cwe_352,</group>
  </rule>

  <rule id="100536" level="12">
    <if_sid>100535</if_sid>
    <regex>Referer</regex>
    <description>CVE-2026-19535: LuCI POST with Referer header and no CSRF token - possible cross-site request forgery exploitation.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_19535,cwe_352,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor fix, no patch source, and no workaround are documented in any tracked source. No affected-version range beyond V1.06.01 is provided in the advisory.

1) Immediate Mitigations (compensating controls)

• Isolate the management interface. Restrict network access to the LuCI interface so that only dedicated, trusted management workstations/subnets can reach it. Do not expose the management UI to general user networks or the internet.
• Harden administrator browsing. Prohibit administrative browsers from visiting untrusted/arbitrary web content while an authenticated management session is active. Use a dedicated, locked-down management browser profile.
• Short session lifetimes / forced logout. Reduce LuCI session/authentication timeouts and require administrators to log out when idle, minimizing the exploitable authenticated-session window.
• Place a CSRF-protecting proxy in front where feasible. If technically viable, front the management UI with a reverse proxy that enforces strict Origin/Referer validation and SameSite=Strict cookie handling — though note this cannot add a synchronizer token the backend does not support.
• Monitor for T1190. Enable the detection rules in this report and monitor for anomalous Referer/Origin values and forged POSTs to the LuCI interface.

2) Patch / Upgrade Steps

• No patch is available. Track the Advantech security advisory for the EKI-1242IEIMS and monitor the NVD entry (CVE-2026-19535) for updates. Contact Advantech support to request a firmware update addressing CWE-352 in the LuCI interface.
• Once a fixed firmware version is published, validate and apply it via the device's management workflow, following the vendor's upgrade procedure. Until then, treat the device as unpatched and rely on mitigations above.

3) Long-Term Hardening

• Enforce anti-CSRF token validation (synchronizer token pattern) and strict SameSite/Origin/Referer checks on all state-changing management operations — this is a vendor-side fix requirement.
• Segment OT networks so that management planes are unreachable from IT/user networks.
• Maintain an inventory of the EKI-1242IEIMS fleet and firmware versions; subscribe to Advantech PSIRT advisories and ICS-CERT/CISA advisories for affected industrial switches.
• Adopt a lifecycle policy that tracks embedded/industrial device firmware and prioritizes management-interface vulnerabilities in exposed OT equipment.

References

1. NVD — CVE-2026-19535: https://nvd.nist.gov/vuln/detail/CVE-2026-19535
2. MITRE CWE-352 — Cross-Site Request Forgery (CSRF): https://cwe.mitre.org/data/definitions/352.html
3. Advantech Security Advisory / PSIRT (vendor advisory — none currently published for this CVE; monitor): https://www.advantech.com/en/support/security
4. Nozomi Networks Labs — credited discoverer of this CVE (research/advisory published at Nozomi Networks Labs).
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild status: No known threat actor campaigns and no in-the-wild exploitation evidence are documented at the time of writing. CVE-2026-19535 is not listed in CISA KEV. No public PoC, Nuclei template, or exploit code is available; EPSS has not yet scored this CVE.