Search
Find a vulnerability
Search criteria
6 vulnerabilities found for WISE-6610P-DEA by Advantech
CVE-2026-79698 (GCVE-0-2026-79698)
Vulnerability from nvd – Published: 2026-09-07 06:30 – Updated: 2026-09-11 20:35
VLAI
EPSS
VEX
Title
Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection
Summary
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 20:15 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/399513 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/399513/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-79698 | third-party-advisory |
| https://vuldb.com/submit/879219 | third-party-advisory |
| https://uvxbywu62qm.feishu.cn/wiki/RgziwoXf2iD9zK… | exploit |
| https://www.advantech.com/zh-tw/security-advisory | related |
| https://www.advantech.com/en-us/support/details/f… | patch |
| https://www.advantech.com/ | product |
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Advantech | WISE-6610-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DEA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DNA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DTA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79698",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T20:15:46.440772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:35:36.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610P-DEA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610P-DNA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610P-DTA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hubdk01 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T06:30:41.668Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-399513 | Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/399513"
},
{
"name": "VDB-399513 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/399513/cti"
},
{
"name": "CVE-2026-79698 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-79698"
},
{
"name": "Submit #879219 | Advantech Technology (China) Co., Ltd. WISE-6610 v1.2.1_20251110 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/879219"
},
{
"tags": [
"exploit"
],
"url": "https://uvxbywu62qm.feishu.cn/wiki/RgziwoXf2iD9zKkI4MJcfWcNn7c?from=from_copylink"
},
{
"tags": [
"related"
],
"url": "https://www.advantech.com/zh-tw/security-advisory"
},
{
"tags": [
"patch"
],
"url": "https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI"
},
{
"tags": [
"product"
],
"url": "https://www.advantech.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-09-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-07T08:03:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-79698",
"datePublished": "2026-09-07T06:30:41.668Z",
"dateReserved": "2026-08-25T12:13:42.095Z",
"dateUpdated": "2026-09-11T20:35:36.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79697 (GCVE-0-2026-79697)
Vulnerability from nvd – Published: 2026-09-07 06:15 – Updated: 2026-09-08 13:42
VLAI
EPSS
VEX
Title
Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection
Summary
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:42 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/399512 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/399512/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-79697 | third-party-advisory |
| https://vuldb.com/submit/879208 | third-party-advisory |
| https://uvxbywu62qm.feishu.cn/wiki/EzwXwS0vKiroHm… | exploit |
| https://www.advantech.com/zh-tw/security-advisory | related |
| https://www.advantech.com/en-us/support/details/f… | patch |
| https://www.advantech.com/ | product |
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Advantech | WISE-6610-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DEA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DNA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DTA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79697",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:42:20.317863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:42:30.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610P-DEA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610P-DNA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610P-DTA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hubdk01 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T06:15:42.278Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-399512 | Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/399512"
},
{
"name": "VDB-399512 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/399512/cti"
},
{
"name": "CVE-2026-79697 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-79697"
},
{
"name": "Submit #879208 | Advantech Technology (China) Co., Ltd. WISE-6610 v1.2.1_20251110 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/879208"
},
{
"tags": [
"exploit"
],
"url": "https://uvxbywu62qm.feishu.cn/wiki/EzwXwS0vKiroHmk9rqzcjP0EnMe?from=from_copylink"
},
{
"tags": [
"related"
],
"url": "https://www.advantech.com/zh-tw/security-advisory"
},
{
"tags": [
"patch"
],
"url": "https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI"
},
{
"tags": [
"product"
],
"url": "https://www.advantech.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-09-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-07T08:02:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-79697",
"datePublished": "2026-09-07T06:15:42.278Z",
"dateReserved": "2026-08-25T12:13:37.537Z",
"dateUpdated": "2026-09-08T13:42:30.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2670 (GCVE-0-2026-2670)
Vulnerability from nvd – Published: 2026-02-18 21:02 – Updated: 2026-09-07 05:58
VLAI
EPSS
VEX
Title
Advantech WISE-6610-NB Background Management openvpn_apply os command injection
Summary
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-20 19:32 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/346467 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/346467/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-2670 | third-party-advisory |
| https://vuldb.com/submit/753293 | third-party-advisory |
| https://github.com/master-abc/cve/issues/37 | exploitissue-tracking |
| https://www.advantech.com/zh-tw/security-advisory | related |
| https://www.advantech.com/en-us/support/details/f… | patch |
| https://www.advantech.com/ | product |
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Advantech | WISE-6610-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DEA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DNA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DTA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2670",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-20T19:32:36.994708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-20T19:32:51.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610P-DEA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610P-DNA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610P-DTA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jiefengliang (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: \"The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T05:58:16.410Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-346467 | Advantech WISE-6610-NB Background Management openvpn_apply os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/346467"
},
{
"name": "VDB-346467 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/346467/cti"
},
{
"name": "CVE-2026-2670 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-2670"
},
{
"name": "Submit #753293 | Advantech WISE-6610 v1.2.1_20251110 OS Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/753293"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/master-abc/cve/issues/37"
},
{
"tags": [
"related"
],
"url": "https://www.advantech.com/zh-tw/security-advisory"
},
{
"tags": [
"patch"
],
"url": "https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI"
},
{
"tags": [
"product"
],
"url": "https://www.advantech.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-02-18T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-09-07T08:02:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Advantech WISE-6610-NB Background Management openvpn_apply os command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-2670",
"datePublished": "2026-02-18T21:02:08.426Z",
"dateReserved": "2026-02-18T09:16:43.848Z",
"dateUpdated": "2026-09-07T05:58:16.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79698 (GCVE-0-2026-79698)
Vulnerability from cvelistv5 – Published: 2026-09-07 06:30 – Updated: 2026-09-11 20:35
VLAI
EPSS
VEX
Title
Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection
Summary
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 20:15 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/399513 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/399513/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-79698 | third-party-advisory |
| https://vuldb.com/submit/879219 | third-party-advisory |
| https://uvxbywu62qm.feishu.cn/wiki/RgziwoXf2iD9zK… | exploit |
| https://www.advantech.com/zh-tw/security-advisory | related |
| https://www.advantech.com/en-us/support/details/f… | patch |
| https://www.advantech.com/ | product |
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Advantech | WISE-6610-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DEA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DNA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DTA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79698",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T20:15:46.440772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:35:36.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610-EL-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610P-DEA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610P-DNA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:*"
],
"modules": [
"Node-RED Library"
],
"product": "WISE-6610P-DTA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hubdk01 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T06:30:41.668Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-399513 | Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/399513"
},
{
"name": "VDB-399513 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/399513/cti"
},
{
"name": "CVE-2026-79698 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-79698"
},
{
"name": "Submit #879219 | Advantech Technology (China) Co., Ltd. WISE-6610 v1.2.1_20251110 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/879219"
},
{
"tags": [
"exploit"
],
"url": "https://uvxbywu62qm.feishu.cn/wiki/RgziwoXf2iD9zKkI4MJcfWcNn7c?from=from_copylink"
},
{
"tags": [
"related"
],
"url": "https://www.advantech.com/zh-tw/security-advisory"
},
{
"tags": [
"patch"
],
"url": "https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI"
},
{
"tags": [
"product"
],
"url": "https://www.advantech.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-09-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-07T08:03:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-79698",
"datePublished": "2026-09-07T06:30:41.668Z",
"dateReserved": "2026-08-25T12:13:42.095Z",
"dateUpdated": "2026-09-11T20:35:36.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79697 (GCVE-0-2026-79697)
Vulnerability from cvelistv5 – Published: 2026-09-07 06:15 – Updated: 2026-09-08 13:42
VLAI
EPSS
VEX
Title
Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection
Summary
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:42 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/399512 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/399512/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-79697 | third-party-advisory |
| https://vuldb.com/submit/879208 | third-party-advisory |
| https://uvxbywu62qm.feishu.cn/wiki/EzwXwS0vKiroHm… | exploit |
| https://www.advantech.com/zh-tw/security-advisory | related |
| https://www.advantech.com/en-us/support/details/f… | patch |
| https://www.advantech.com/ | product |
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Advantech | WISE-6610-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DEA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DNA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DTA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79697",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:42:20.317863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:42:30.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610-EL-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610P-DEA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610P-DNA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:*"
],
"modules": [
"Basic Station Certificate-Deletion Handler"
],
"product": "WISE-6610P-DTA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hubdk01 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T06:15:42.278Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-399512 | Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/399512"
},
{
"name": "VDB-399512 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/399512/cti"
},
{
"name": "CVE-2026-79697 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-79697"
},
{
"name": "Submit #879208 | Advantech Technology (China) Co., Ltd. WISE-6610 v1.2.1_20251110 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/879208"
},
{
"tags": [
"exploit"
],
"url": "https://uvxbywu62qm.feishu.cn/wiki/EzwXwS0vKiroHmk9rqzcjP0EnMe?from=from_copylink"
},
{
"tags": [
"related"
],
"url": "https://www.advantech.com/zh-tw/security-advisory"
},
{
"tags": [
"patch"
],
"url": "https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI"
},
{
"tags": [
"product"
],
"url": "https://www.advantech.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-09-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-07T08:02:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-79697",
"datePublished": "2026-09-07T06:15:42.278Z",
"dateReserved": "2026-08-25T12:13:37.537Z",
"dateUpdated": "2026-09-08T13:42:30.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2670 (GCVE-0-2026-2670)
Vulnerability from cvelistv5 – Published: 2026-02-18 21:02 – Updated: 2026-09-07 05:58
VLAI
EPSS
VEX
Title
Advantech WISE-6610-NB Background Management openvpn_apply os command injection
Summary
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-20 19:32 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/346467 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/346467/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-2670 | third-party-advisory |
| https://vuldb.com/submit/753293 | third-party-advisory |
| https://github.com/master-abc/cve/issues/37 | exploitissue-tracking |
| https://www.advantech.com/zh-tw/security-advisory | related |
| https://www.advantech.com/en-us/support/details/f… | patch |
| https://www.advantech.com/ | product |
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Advantech | WISE-6610-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-NB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-EB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-TB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-JB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610-EL-CB |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DEA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DNA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:* |
|
| Advantech | WISE-6610P-DTA |
Affected:
1.2.1_20251110
Unaffected: 1.2.4_20260821 cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2670",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-20T19:32:36.994708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-20T19:32:51.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-NB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-EB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-TB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-JB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610-EL-CB",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610P-DEA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610P-DNA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
},
{
"cpes": [
"cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:*"
],
"modules": [
"Background Management"
],
"product": "WISE-6610P-DTA",
"vendor": "Advantech",
"versions": [
{
"status": "affected",
"version": "1.2.1_20251110"
},
{
"status": "unaffected",
"version": "1.2.4_20260821"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jiefengliang (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: \"The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T05:58:16.410Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-346467 | Advantech WISE-6610-NB Background Management openvpn_apply os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/346467"
},
{
"name": "VDB-346467 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/346467/cti"
},
{
"name": "CVE-2026-2670 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-2670"
},
{
"name": "Submit #753293 | Advantech WISE-6610 v1.2.1_20251110 OS Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/753293"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/master-abc/cve/issues/37"
},
{
"tags": [
"related"
],
"url": "https://www.advantech.com/zh-tw/security-advisory"
},
{
"tags": [
"patch"
],
"url": "https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI"
},
{
"tags": [
"product"
],
"url": "https://www.advantech.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-02-18T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-09-07T08:02:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Advantech WISE-6610-NB Background Management openvpn_apply os command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-2670",
"datePublished": "2026-02-18T21:02:08.426Z",
"dateReserved": "2026-02-18T09:16:43.848Z",
"dateUpdated": "2026-09-07T05:58:16.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}