CVE-2026-73175

Executive Summary

CVE-2026-73175 is an uncontrolled resource consumption (CWE-400) vulnerability in the OPC UA gateway component of the Advantech EKI-1242EIMS industrial managed Ethernet switch, confirmed in firmware V1.06.01 by Nozomi Networks Labs. An adjacent, unauthenticated attacker can open multiple anonymous OPC UA sessions to exhaust the gateway's server session pool, denying OPC UA service to all legitimate clients. The impact is a complete, low-complexity denial of service against an OT/ICS network element that typically bridges field devices to industrial supervisory systems.

Technical Analysis

The Advantech EKI-1242EIMS is an industrial Ethernet switch that exposes an integrated OPC UA gateway. OPC UA (IEC 62541) servers implement a session concept: clients establish a session with a server, and each session consumes server-side resources (session state, security channel context, subscribed items, and per-session memory). Servers enforce a finite maximum-session limit. When the session pool is exhausted, the server rejects new CreateSession requests or fails to allocate resources, so legitimate clients cannot obtain a usable connection.

The specific flaw is CWE-400: Uncontrolled Resource Consumption. The gateway accepts anonymous session creation — i.e., sessions not authenticated against user credentials or certificate-based identity. Anonymous session establishment is a legitimate OPC UA configuration for certain deployments, but it removes the attacker's need for valid credentials. Because anonymous sessions are unauthenticated and (per the advisory) can be opened repeatedly, an adjacent attacker on the same network segment can consume every slot in the finite server session pool. The attack does not require a crash, memory corruption, or malformed protocol frames: it abuses expected protocol behavior (CreateSession over the open OPC UA endpoint) to deplete a bounded server resource. This is a classic resource-exhaustion / availability attack in which the protocol itself is the weapon.

Technical causal factors, as derivable from the description:

• The gateway's session-pool limit is finite and smaller than the number of sessions an attacker can open.
• Sessions are unauthenticated (anonymous), so no account or certificate is needed.
• The gateway apparently allows the pool to be fully saturated without enforcing idle-session reclamation, per-origin rate limits, or pre-session throttling strict enough to keep legitimate clients connected.
• The failure is a complete denial of service to all legitimate OPC UA clients, indicating the gateway does not reserve or prioritize capacity for authenticated or existing clients.

Attack surface: the OPC UA gateway's TCP listener, reachable by an adjacent (same L2/L3 segment or routed-adjacent) network position. Session establishment is a pre-authentication operation, and the advisory explicitly frames the attacker as unauthenticated.

Note that no CVE score or vector is published (NVD CVSS: N/A), and no exploit code, PoC, or Nuclei template is known. No patch evidence exists in any tracked source (patch confidence 0/4). Any CVSS vector in this report is a reasoned estimate based on the described conditions (adjacent access, no privileges, no user interaction, availability-only impact) and must be treated as provisional.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-400) and the CNA description. No specific function names, URL paths, or parameters are asserted because none were provided.

1. Reconnaissance / target identification. An attacker with a presence on the OT network (or a routed path to the segment) identifies the EKI-1242EIMS OPC UA gateway by scanning for the standard OPC UA TCP service port (4840/tcp) or by identifying the device via industrial-asset discovery. The attacker confirms the gateway permits anonymous session establishment — a capability that is openly discoverable during the OPC UA GetEndpoints / session handshake, since the server advertises its supported security policies and user-token policies (including anonymous) to any connecting client.

2. Triggering the flaw class. The attacker's client repeatedly issues anonymous OPC UA CreateSession requests (the session-establishment operation defined by the OPC UA specification). Each accepted anonymous session consumes one slot of the gateway's finite server session pool. The attacker is not required to authenticate; the "flaw trigger" is simply continuing to open sessions until the pool is exhausted. No malformed input is required — this is the abuse of legitimate protocol operations, which is why the weakness is resource consumption rather than a parsing, memory-safety, or injection bug.

3. Payload / execution method (class level). No exploit payload in the memory-corruption sense exists. The "payload" is the volume and persistence of valid anonymous session requests. The attacker maintains session state (or keeps reopening sessions) to keep the pool at capacity, ensuring that freed slots are immediately re-consumed. Because the attack uses the protocol correctly, it is not detectable by signature-based protocol-anomaly checkers looking for malformed frames; detection must be behavioural (session-count and origin-based).

4. Post-exploitation impact. With the pool exhausted, new legitimate OPC UA clients cannot connect and existing legitimate sessions may be denied or dropped — the advisory describes a complete denial of service to all legitimate OPC UA clients. Because OPC UA is typically the data path to SCADA/HMI/supervisory layers, loss of the gateway can blind operators to field data or sever supervisory control, a safety-relevant outcome in industrial environments. The attacker gains no confidentiality or integrity impact from this CVE alone, but the resulting OT outage can be leveraged as a diversion or as a pre-cursor for subsequent attacks.

Constraints and caveats. Impact is availability-only. The attacker must be adjacent/network-accessible to the OPC UA endpoint. If the deployment has disabled anonymous sessions, requires certificate-based user tokens, or segments the OPC UA endpoint behind a firewall, the described attack path is not available. No exploit-in-the-wild or named threat-actor activity is documented for this CVE.

Impact Assessment

The pre-eminent impact is loss of availability: the affected EKI-1242EIMS OPC UA gateway stops serving all legitimate clients. Confidentiality and integrity are not directly affected. Using a provisional first-estimate vector of CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base score 6.5, Adjacent), the dominant factor is the high availability impact combined with no authentication requirement and low attack complexity. If the OPC UA endpoint is reachable from a broader (routed) network, the effective attack surface is larger than "adjacent" implies, though the CNA explicitly characterises the attacker as adjacent.

Affected systems. Advantech EKI-1242EIMS running firmware V1.06.01. Adjacent OPC UA clients (SCADA servers, HMI workstations, historians, engineering tools, and any OPC UA client that consumes the gateway) are the blast radius. Because the device is a managed industrial switch, loss of the OPC UA gateway is an OT availability event, not merely an IT application outage.

Business impact. In production environments: supervisory visibility loss and potential control interruption, unplanned downtime cost, and a widened exposure window because the vulnerability is unpatched (patch confidence 0/4; no vendor fix, workaround, or fixed-version reference is available in the data). The absence of a CVE score, EPSS value, or KEV listing means risk ranking cannot rely on external prioritisation — operators must triage by asset criticality. No OSV packages apply, as this is firmware rather than an application package.

Detection Guidance

Detection strategy: because the attack is protocol-legal, monitoring must be based on session-creation rates per source, anonymous session counts, and session-pool saturation, plus log evidence from the device and connected OPC UA clients.

Sigma Rule

title: Multi-Anonymous OPC UA Session Creation Against Advantech EKI-1242EIMS Gateway
id: 8f7a1e2c-4b9d-4f3a-9c61-0d5e7a2b6f11
status: experimental
description: Detects a high rate of anonymous OPC UA CreateSession activity targeting an OPC UA gateway, consistent with CWE-400 session-pool exhaustion (CVE-2026-73175).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73175
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026-73175
logsource:
  category: application
  product: opcua
detection:
  selection:
    event_type: 'CreateSession'
    anonymous_session: true
  timeframe: 2m
  condition: selection | count() by source_ip > 50
fields:
  - source_ip
  - event_type
  - anonymous_session
falsepositives:
  - Legitimate OPC UA client reconnect storms after network maintenance
  - Redundant client architectures establishing many short-lived sessions
level: medium

YARA Rule

rule OPCUA_Anonymous_Session_Flood_Gateway
{
    meta:
        author = "valtersit.com"
        description = "Detects repeatedly repeated OPC UA CreateSession request artifacts in capture/log exports associated with CVE-2026-73175 session exhaustion"
        cve = "CVE-2026-73175"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73175"
        date = "2026-01-01"

    strings:
        $opc_hello   = { "HEL" "F" }                 // OPC UA TCP Hello message marker ("HELF")
        $opc_create  = { 04 01 00 00 }               // OPC UA CreateSession request (node/type marker, pattern form)
        $sess_word   = "CreateSession" ascii wide nocase
        $anon_word   = "Anonymous" ascii wide nocase

    condition:
        uint16(0) == 0x4845 or
        (any of ($sess_word, $anon_word) and $opc_create) or
        (#opc_hello > 20)
}

Note: the byte patterns above are illustrative of the OPC UA TCP framing markers; validate and tune against real traffic from the affected gateway before operational use.

Suricata IDS Rule

alert tcp any any -> any 4840 ( \
  msg:"CVE-2026-73175 Possible OPC UA Anonymous Session Flood / Session Pool Exhaustion"; \
  flow:established,to_server; \
  content:"|48 45 4C 46|"; depth:4; \
  threshold:type both, track by_src, count 100, seconds 60; \
  classtype:attempted-dos; \
  reference:cve,2026-73175; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73175; \
  sid:202673175; rev:1; )

This rule fires on a high rate of OPC UA TCP "HELLO" handshakes (the HELF frame marker) from a single source, the observable precursor to anonymous session-pool exhaustion. It will not distinguish anonymous from authenticated sessions (that requires OPC UA-layer parsing); it is a volume-based approximation and should be tuned to reduce false positives from legitimate reconnect storms.

Elastic Detection

sequence by source.ip with maxspan=2m
  [network where network.transport == "tcp" and destination.port in (4840, 4841)
     and event.action == "connection_started"]
  [network where network.transport == "tcp" and destination.port in (4840, 4841)
     and event.action == "connection_started"]
  [network where network.transport == "tcp" and destination.port in (4840, 4841)
     and event.action == "connection_started"]

Because anonymous session creation is not a distinct network event, this EQL sequence detects rapid repeated OPC UA TCP connection establishment to the gateway, the transport-level symptom of a session flood. Correlate with the device's own OPC UA session logs where available.

Splunk SPL Query

index=ot OR index=network (sourcetype="opcua:session" OR sourcetype="zeek:conn" OR sourcetype="firewall")
| search (event_type="CreateSession" anonymous=true) OR (dest_port=4840 service="opcua")
| where (event_type="CreateSession")
| bin _time span=1m
| stats count as sessions dc(src) as unique_sources by src, _time
| where sessions > 50
| table _time src sessions unique_sources
| sort - sessions

Broader variant for flow-only telemetry:

index=network dest_port IN (4840,4841) service="opcua"
| bin _time span=1m | stats count by src, _time | where count > 100

Wazuh OSSEC Rule

<group name="opcua,cve-2026-73175,">
  <rule id="2026731" level="3">
    <decoded_as>opcua-session</decoded_as>
    <field name="event_type">CreateSession</field>
    <description>OPC UA session creation observed (CVE-2026-73175 context)</description>
  </rule>

  <rule id="2026732" level="10" frequency="50" timeframe="120">
    <if_matched_sid>2026731</if_matched_sid>
    <same_field>srcip</same_field>
    <field name="anonymous">true</field>
    <description>CVE-2026-73175: possible OPC UA anonymous session-pool exhaustion (50+ anon sessions in 120s from same source)</description>
    <mitre><id>T1499</id></mitre>
  </rule>
</group>

Requires a decoder that extracts event_type, anonymous, and srcip from OPC UA gateway session logs or from the forwarder that normalises OPC UA audit events.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, hotfix, or fixed firmware version is evidenced in any tracked source; no vendor workaround is documented. Treat the device as vulnerable until Advantech publishes a fix and coordinate with Advantech support for EKI-1242EIMS firmware updates.

1. Immediate mitigations.

   • Network-segment the OPC UA gateway: restrict TCP 4840 (and 4841 where applicable) to only the specific, known OPC UA client IP addresses that need it, using switch ACLs or an industrial firewall. The advisory frames the attacker as adjacent; strict segmentation removes the adjacent attack path.
   • Disable anonymous user-token policy on the OPC UA gateway if operations permit, requiring certificate- or username-based user tokens. This directly closes the unauthenticated session path.
   • Do not expose the OPC UA endpoint to broader routed networks or the internet.
   • Monitor session counts and set alarms on per-source anonymous session growth.
   • Where the gateway supports it, apply connection/session rate limiting and idle-session timeout tuning (test carefully; poor tuning can worsen availability).

2. Patch / upgrade steps.

   • Track Advantech's security advisories for EKI-1242EIMS. No fixed version is currently identified in the data provided.
   • Open a case with Advantech support to request a firmware remediation timeline and interim guidance specific to V1.06.01.
   • When a fix is released, stage, back up configuration, and schedule an OT maintenance window; validate that the fix restores/enforces session limits and anonymous-session controls before re-enabling the full client set.

3. Long-term hardening.

   • Enforce OPC UA security policies (signed/encrypted channels and certificate-based user authentication) by default; never ship or run anonymous-only gateways in production.
   • Baseline normal session behaviour per gateway and alert on deviations (session count, per-source rate, anonymous ratio).
   • Maintain an OT asset inventory and a vulnerability-management cadence that includes firmware, since package-based scanners (OSV) do not cover this device.
   • Apply defence-in-depth: industrial firewalls with DPI, network zoning (Purdue model), and redundancy so that loss of one OPC UA gateway does not sever all supervisory visibility.
   • Track CISA/ICS-CERT advisories for Advantech and for OPC UA implementations generally, and re-check CVE-2026-73175 for an EPSS score and KEV status once published.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73175
• CWE-400 (Uncontrolled Resource Consumption): https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499 (Endpoint Denial of Service): https://attack.mitre.org/techniques/T1499/
• Advantech product security / advisory portal: https://www.advantech.com/en-eu/support/security (consult for EKI-1242EIMS firmware advisories)
• Nozomi Networks Labs (reporting researcher) security advisories: https://www.nozominetworks.com/blog (research findings and ICS advisories)

Threat-actor and in-the-wild note: no exploit code, PoC, Nuclei template, or CISA KEV entry is associated with CVE-2026-73175 as of this report; no named threat-actor campaign is attributable. The advisory originates from Nozomi Networks Labs. Any future exploit development should be monitored, as unauthenticated availability attacks against OT gateways are attractive to both criminal and hacktivist actors seeking disruptive effects.