CVE-2026-73173

Executive Summary

CVE-2026-73173 is a CWE-306 Missing Authentication for Critical Function vulnerability in the edgserver management protocol of the Advantech EKI-1242EIMS industrial Ethernet switch, confirmed in firmware version V1.06.01. A remote, unauthenticated attacker who can reach TCP port 5058 can invoke critical device-management functions — including network reconfiguration, reboot, factory reset, and firmware upgrade — without supplying any credentials. The impact is a full compromise of device integrity and availability on industrial networks, with no authentication barrier and no patch currently available.

Technical Analysis

The vulnerability is a textbook CWE-306 (Missing Authentication for Critical Function) condition. According to the NVD description, the edgserver management protocol exposes critical device-management operations over TCP/5058 and performs no authentication check before executing them. The protocol is network-reachable, meaning the trust boundary is effectively "any host with IP connectivity to port 5058."

The affected product is the Advantech EKI-1242EIMS, an industrial managed Ethernet switch. Firmware version V1.06.01 is explicitly named as vulnerable. The edgserver service is the management protocol listener that accepts inbound requests on TCP port 5058.

Mechanistically, this class of flaw occurs when a service dispatches privileged operations (configuration write, reboot, reset, firmware write) based solely on the receipt of a well-formed request, with no session validation, token check, or credential verification. Because the operations are administrative by nature, the absence of authentication means the request itself constitutes authorization. No specific packet format, function name, or parameter is disclosed in the source data, so the exact wire-level syntax of a crafted request is not publicly documented at this time; it is described only as "sending crafted requests to TCP port 5058."

Key technical observations derivable from the data:

• Attack vector is network (remote), requiring only reachability to TCP/5058.
• No privileges or user interaction are required — the function is invoked unauthenticated.
• The exposed functions are destructive/administrative: network reconfiguration, reboot, reset, firmware upgrade.
• Firmware upgrade exposure is particularly severe: an attacker could push malicious or incompatible firmware, converting a configuration attack into potential persistent compromise of the device.

The absence of authentication on a firmware-upgrade path is the highest-severity element. While the CVE carries no assigned CVSS score in the source data (N/A), the qualitative impact maps to high confidentiality, integrity, and availability loss.

Exploitation Scenarios

No public PoC or exploit code exists. The attack chain below is inferred strictly from the vulnerability class (CWE-306) and the operations named in the NVD description. No function names, endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. An attacker scans for hosts exposing TCP port 5058, the edgserver management protocol. Industrial networks are frequently identified by product banners; Shodan-style queries for port 5058 combined with Advantech EKI identifiers surface internet- or WAN-reachable instances. In OT environments, the attacker may already be positioned on a flat Layer-2 segment where the switch management interface is reachable.

2. Triggering the flaw class. Because authentication is missing for the critical functions, the attacker does not need to obtain credentials, forge a session, or bypass a login. The attacker opens a TCP connection to port 5058 and sends a crafted request corresponding to a device-management operation. The service processes the request without any identity check.

3. Payload / execution method (class level). For CWE-306, the "payload" is simply a valid protocol message naming an administrative action. Based on the description, the attacker can select among: network reconfiguration (e.g., changing IP/MGMT settings or VLAN behavior), reboot, reset, and firmware upgrade. The exact message encoding is not disclosed; no specific verb, opcode, or parameter name can be asserted.

4. Post-exploitation impact. Successful invocation yields full administrative control over device state. Reconfiguration can sever or reroute network segments; reboot/reset causes denial of service and loss of configuration; firmware upgrade — if abused — offers a path to persistent manipulation of the device. In OT/ICS contexts, manipulating a switch can disrupt process connectivity, isolate safety systems, or facilitate lateral movement by altering network segmentation.

Impact Assessment

The affected asset is an industrial managed Ethernet switch positioned in OT/ICS or critical-infrastructure networks. Because the vulnerable function set covers reconfiguration, reboot, reset, and firmware upgrade, a single unauthenticated request can eliminate availability (reboot/reset) and integrity (reconfiguration/firmware) of the device.

Blast radius extends beyond the device itself: an Ethernet switch is a network chokepoint. Reconfiguring it can deny connectivity to downstream PLCs, RTUs, HMIs, or safety instrumented systems, effectively turning one compromised switch into an outage or a segmentation-bypass primitive. Firmware-level abuse raises the possibility of persistence and supply-chain-style tampering within the OT segment.

Mapping the data to the standard CVSS 3.1 qualitative model (no official score assigned — N/A): the vector is network (AV:N), complexity low (AC:L), no privileges (PR:N), no user interaction (UI:N); confidentiality, integrity, and availability each rate high given the ability to read/modify device state and force reboots. This yields CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H as an analytical estimate, capped at scope-unchanged since only the device and its immediate network behavior are affected. Note: this is an inferred vector, not an official NVD-assigned score.

No CISA KEV listing, no EPSS score, and no evidence of in-the-wild exploitation are present in the source data.

Detection Guidance

Sigma Rule

title: Unauthenticated edgserver Management Function Invocation (CVE-2026-73173)
id: 8f3c1a72-4b2e-4d19-9c7a-2a6e71c90413
status: experimental
description: Detects network connections to TCP/5058 (edgserver) on Advantech EKI-1242EIMS devices, indicative of unauthenticated management function abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73173
author: valtersit.com
date: 2026-01-01
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort: 5058
  selection_init:
    Initiated: 'true'
  condition: selection_port and selection_init
falsepositives:
  - Authorized management traffic from known admin hosts
level: high
tags:
  - attack.t1190
  - cve.2026-73173

YARA Rule

rule CVE_2026_73173_Advantech_EKI_edgserver
{
    meta:
        description = "Detection of Advantech EKI-1242EIMS edgserver management protocol artifacts (CVE-2026-73173)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73173"
        date = "2026-01-01"
        cve = "CVE-2026-73173"

    strings:
        $s1 = "edgserver" ascii nocase
        $s2 = "EKI-1242EIMS" ascii nocase
        $s3 = "V1.06.01" ascii
        $s4 = "Advantech" ascii nocase

    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> any 5058 (msg:"CVE-2026-73173 Advantech EKI edgserver Unauthenticated Management Function Access Attempt"; flow:to_server,established; content:"edgserver"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-73173; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73173; sid:202673173; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where destination.port == 5058 and network.direction == "outbound" ]
  [ network where destination.port == 5058 ]

Splunk SPL Query

index=network (dest_port=5058 OR destination_port=5058)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count
| table src_ip, dest_ip, dest_port, count, first_seen, last_seen

Wazuh OSSEC Rule

<group name="advantech,cve-2026-73173,">
  <rule id="2026731" level="12">
    <decoded_as>json</decoded_as>
    <field name="dest_port">5058</field>
    <description>CVE-2026-73173: Possible unauthenticated edgserver management access to Advantech EKI-1242EIMS on TCP/5058</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73173,attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No vendor fix, advisory, or tracked patch source exists in the data. Remediation must therefore be architectural and compensating until Advantech publishes firmware.

1. Immediate mitigations.

   • Block or restrict TCP/5058 at network boundaries. Ensure port 5058 is never exposed to the internet or to untrusted WAN/VPN segments.
   • Segment OT/ICS networks so the switch management plane is reachable only from a hardened, dedicated management VLAN with strict ACLs.
   • Place the device behind a firewall or OT-aware intrusion prevention system enforcing allow-lists for administrative sources.
   • Disable or filter the edgserver management protocol where an alternative, authenticated management channel exists — verify with the vendor whether it can be disabled.
   • Remove any port-forwarding, UPnP, or NAT rules that map 5058 to the device.
   • Monitor logs and network telemetry for unexpected connections to 5058 and for abrupt device reboots/resets that could indicate abuse.

2. Patch / upgrade steps.

   • No patch is available as of this report. Contract Advantech support directly and monitor the vendor security advisory channel for a fixed firmware release beyond V1.06.01.
   • When a fixed firmware is released, schedule an update window, validate the firmware hash/signature, and apply it to all EKI-1242EIMS units running V1.06.01.
   • Until then, treat V1.06.01 devices as untrusted-at-the-edge and keep them fully isolated from routable networks.

3. Long-term hardening.

   • Adopt an OT asset inventory and continuous exposure-monitoring program to detect devices exposing management protocols.
   • Enforce network segmentation and zero-trust access for all industrial control devices.
   • Require authenticated, encrypted management protocols; deprecate any protocol lacking authentication.
   • Maintain firmware lifecycle tracking and subscribe to vendor/CISA ICS advisories; apply patches on a defined cadence.
   • Conduct periodic penetration tests of OT switches and validate compensating controls.

References

• NVD — CVE-2026-73173: https://nvd.nist.gov/vuln/detail/CVE-2026-73173
• Nozomi Networks Labs (reported by, per NVD description)
• Advantech security advisory channel (no specific advisory identified in source data — verify directly with vendor)
• CWE-306 Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploitation status: No public PoC, no Nuclei template, no exploit code, no CISA KEV listing, and no EPSS score in the source data. There is no tracked evidence of in-the-wild exploitation or named threat-actor campaigns associated with this CVE at the time of writing.