CVE-2026-73171

Executive Summary

CVE-2026-73171 is a CWE-73 (External Control of File Name or Path) vulnerability in the backup-restore workflow of the Advantech EKI-1242EIMS industrial Ethernet switch, affecting firmware version V1.06.01. A remote authenticated attacker can upload a crafted backup archive through the device web management interface to overwrite arbitrary files on the device filesystem. Because this class of flaw permits attacker-controlled write destinations, successful exploitation can corrupt configuration, disable management services, or achieve code execution depending on what files are overwritten — a serious availability and integrity risk for OT/ICS network segments. No public PoC, Nuclei template, or known in-the-wild exploitation has been observed, and the issue is currently UNPATCHED.

Technical Analysis

CWE-73 describes a condition where the software does not properly neutralize externally supplied input that is used to construct a filesystem path. In this instance, the vulnerable surface is the backup-restore workflow reachable through the web management interface of the EKI-1242EIMS.

The intended function of a backup-restore workflow is to accept an archive uploaded by an administrator and unpack its contents back into known, fixed locations on the device. The flaw manifests when the archive's internal path metadata (i.e., the file names or relative paths recorded inside the archive) is trusted and concatenated with an extraction root without normalization or containment checks. This is the classic "archive extraction path traversal" variant of CWE-73, frequently associated with entries containing ../ sequences or absolute paths.

What the description establishes:

• The attack vector is the web management interface, a network-reachable management plane.
• The attacker is remote and authenticated — the management plane is not unauthenticated-exposed by the vulnerability itself.
• The primitive is arbitrary file overwrite on the device filesystem, driven by a crafted backup archive.
• Affected firmware is V1.06.01 on the EKI-1242EIMS model.

What the description does NOT establish (and this report will not invent): the exact URL endpoint, form field name, archive format, extraction utility, or destination directory. Those specifics are absent from the NVD record and no vendor advisory has surfaced to fill them.

The impact class is significant because arbitrary file overwrite on an embedded device is rarely limited to "just a config file." Overwriting executables, startup scripts, web-root content, or credential stores can pivot an integrity bug into persistent code execution, authentication bypass, or a permanent denial of service (bricked device requiring RMA). On an industrial switch positioned at a cell/zone boundary, this directly threatens segmentation integrity.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-73171. The attack chain below is inferred strictly from the vulnerability class (CWE-73) and the CNA description. Specific endpoints, parameter names, and archive formats are unknown and are deliberately not fabricated.

1. Reconnaissance / target identification. The attacker identifies an EKI-1242EIMS reachable on a management network. Exposure is typically on TCP 80/443 for the web management interface. Shodan-style discovery targets the product banner and management page title. The device must be on firmware V1.06.01 to be confirmed vulnerable.

2. Credential acquisition. The flaw requires authentication. The attacker must already hold valid management credentials (obtained via default credential abuse, credential reuse from an earlier breach, or a separate auth-bypass vector). This step is the primary gating factor and reduces the effective attack surface to insider threats and post-compromise lateral movement.

3. Triggering the flaw. The attacker authenticates to the web management interface and locates the backup-restore function. Instead of uploading a legitimate backup, they upload a crafted archive whose entry names carry path-traversal sequences or absolute paths. When the device extracts the archive, the untrusted path metadata is used to resolve write destinations, causing files to be written outside the intended restore directory — the arbitrary-overwrite condition described by CWE-73.

4. Payload and execution method. Because no specific implementation detail is disclosed, the payload is described at the class level: the overwritten files may be configuration data (leading to misconfiguration/DoS), startup or service scripts (leading to code execution on reboot), or the web application's own assets (leading to persistent XSS or auth-bypass). Actual effect depends entirely on which paths the traversal can reach.

5. Post-exploitation impact. The attacker obtains persistent, device-level integrity compromise. Realistic outcomes: replacement of management UI content for credential phishing, disabling of monitoring/logging forwarding, alteration of switch configuration to bypass segmentation, or rendering the device unbootable (denial of service). Persistence may survive reboots if startup scripts are targeted.

Impact Assessment

• Confidentiality: Low-to-None. The primitive is write-oriented; the description does not indicate read/leak capability.
• Integrity: High. Arbitrary file overwrite is a direct, high-severity integrity violation.
• Availability: High. Overwriting critical files can brick the device or disable management.
• Privileges Required: Low (authenticated). The attacker needs any valid management account.
• Attack Vector: Network. The web management interface is remotely reachable.
• User Interaction: None. No victim action beyond an authenticated upload.

Blast radius. Advantech EKI-1242EIMS switches are deployed in industrial control and OT environments. A compromised switch on a cell boundary can undermine network segmentation, enabling east-west movement between OT zones. Because the device is typically unmonitored compared to IT assets, persistence here is valuable to a patient adversary.

Business impact. Downtime of an industrial switch can halt production lines. Device bricking incurs RMA cost and field-service dispatch. If the device serves as a gateway between IT and OT, the compromise is a stepping stone to higher-value targets. CISA KEV status: NOT listed. EPSS: Not yet scored. No known exploitation in the wild. CVSS: N/A — no official score published by NVD; any score in this report is an analyst estimate and must not be treated as authoritative.

Detection Guidance

Sigma Rule

title: Advantech EKI-1242EIMS Backup Restore Path Traversal File Overwrite
id: 8f3c1a2e-7317-4b71-a0c1-202673171a01
status: experimental
description: Detects upload of backup archive with path traversal attempt against EKI web management interface (CVE-2026-73171)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73171
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1565
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_path:
    cs-uri-stem|contains:
      - 'backup'
      - 'restore'
      - 'firmware'
      - 'upload'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e%5c'
  condition: selection_method and selection_path and selection_traversal
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate backup filenames containing encoded periods
level: high

YARA Rule

rule CVE_2026_73171_EKI_Backup_Traversal_Archive
{
    meta:
        description = "Detects crafted backup archives targeting Advantech EKI-1242EIMS path traversal (CVE-2026-73171)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73171"
        date = "2026-01-01"
        severity = "high"

    strings:
        $zip_magic   = { 50 4B 03 04 }
        $tar_magic   = { 75 73 74 61 72 }
        $traversal_1 = "../"
        $traversal_2 = "..\\"
        $traversal_3 = "/etc/"
        $traversal_4 = "/tmp/"
        $traversal_5 = "etc/passwd"
        $traversal_6 = "etc/shadow"

    condition:
        ($zip_magic at 0 or $tar_magic at 257) and
        any of ($traversal_*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-73171 Advantech EKI backup restore path traversal attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"restore"; nocase; http.request_body; content:"../"; distance:0; reference:cve,2026-73171; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73171; classtype:attempted-admin; sid:202673171; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method == "POST" and
      http.request.body.content : ("*../*" or "*..\\*" or "*%2e%2e%2f*") ]
  [ network where network.protocol == "http" and http.response.status_code >= 200 and
      http.response.status_code < 300 and
      url.path : ("*backup*" or "*restore*" or "*upload*") ]

Splunk SPL Query

index=web
| search http_method=POST
| search (uri_path="*restore*" OR uri_path="*backup*" OR uri_path="*upload*")
| search (uri_query="*../*" OR uri_query="*..%5c*" OR uri_query="*%2e%2e%2f*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, status
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,advantech,cve_2026_73171,">
  <rule id="2026731" level="12">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>restore|backup|upload</url>
    <description>CVE-2026-73171: Possible Advantech EKI backup restore path traversal upload</description>
    <mitre>
      <id>T1190</id>
      <id>T1565</id>
    </mitre>
    <group>cve_2026_73171,web_attack,</group>
  </rule>
  <rule id="2026732" level="14">
    <if_sid>2026731</if_sid>
    <match>\.\./|\.\.\\|%2e%2e%2f</match>
    <description>CVE-2026-73171: Confirmed path traversal sequences in backup restore request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source.

1) Immediate mitigations.

• Remove the web management interface from any internet- or untrusted-network exposure. Restrict management access to a dedicated out-of-band management VLAN.
• Enforce strict access control: audit all accounts with web GUI access, rotate credentials, disable unused accounts, and enable MFA if the platform supports it.
• Restrict upload/backup-restore functionality to trusted administrators only and monitor for its use.
• Deploy IDS/IPS signatures (above) at the boundary of the OT management segment to catch traversal sequences in archive uploads.
• Take offline configuration backups so a bricked or corrupted device can be recovered quickly.

2) Patch / upgrade steps.

• No fixed firmware version is published. Contact Advantech support and reference CVE-2026-73171 to request an advisory and fixed firmware for the EKI-1242EIMS. Do not assume a later V1.06.0x build is patched without vendor confirmation.
• Monitor the vendor security advisory page and the NVD record for a fix reference. Until a fix exists, treat affected devices as unpatched.

3) Long-term hardening.

• Adopt a vulnerability management process that ingests CVE data for OT/ICS assets and tags unpatched items.
• Enforce network segmentation with strict firewall rules between IT and OT zones; do not rely on the switch itself as a security control.
• Apply least-privilege to all device management accounts and log all administrative actions to a centralized SIEM.
• Set a firmware lifecycle policy requiring vendor advisories before deploying new device models in production.

References

• NVD — CVE-2026-73171: https://nvd.nist.gov/vuln/detail/CVE-2026-73171
• CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• Advantech Security Advisories: https://www.advantech.com/en/support/security-advisories (no advisory confirmed for this CVE at time of writing)
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog (NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploitation status. No exploitation in the wild has been observed for CVE-2026-73171. No public proof-of-concept, Nuclei template, or exploit code is available. No threat actor campaign is associated. The vulnerability is not in CISA KEV and has no EPSS score. Any claim of active exploitation should be treated as unverified.