CVE-2026-73174

HighCVSS 8.7/10Last modified Sep 23, 2026

Description

Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata in cleartext.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-319

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Sep 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-731757.1Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-CVE-2026-731768.6Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera CVE-2026-731778.6Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of CVE-2026-731787.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can CVE-2026-731798.1Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a re CVE-2026-73185.9A vulnerability was detected in elie mcp-project 0.1.0. The affected element is the function search_papers of the file research_server.py. T CVE-2026-731806.8Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed af CVE-2026-731817.5Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.CVE-2026-731827.1Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.CVE-2026-731839.3Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.CVE-2026-731847.1Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.CVE-2026-731859.3Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.