This vulnerability, identified by Nozomi Networks Labs, affects the Modbus CSV import functionality of Advantech EKI-1242IEIMS devices running firmware version 1.06.01 or earlier. It is classified as CWE-94: Improper Control of Generation of Code ('Code Injection'). An attacker with authentication privileges can exploit this flaw by crafting a malicious CSV file that, when imported, executes arbitrary Lua code on the device, potentially compromising its integrity and functionality.

Successful exploitation allows remote authenticated attackers to execute arbitrary Lua code on the affected device, which could lead to unauthorized control or disruption of device operations. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the device's Modbus CSV import functionality to trusted users only and monitor for suspicious activity related to file imports.