CVE-2026-79697 in WISE-6610-NB
Summary
by MITRE • 09/07/2026
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The identified vulnerability resides within the Advantech WISE-6610 series of industrial IoT gateways, specifically affecting models including the WISE-6610-NB, WISE-6610-EB, and their EL and P variants running firmware version 1.2.1_20251110 or earlier. This security flaw is located in the Basic Station Certificate-Deletion Handler component, which is responsible for managing certificate lifecycle operations within the device's LoRaWAN stack implementation. The core technical issue stems from a command injection vulnerability triggered by improper input validation and sanitization of arguments passed to the basicstation_apply function. Specifically, manipulation of the act argument allows an attacker to inject arbitrary operating system commands that are executed with elevated privileges on the underlying Linux-based firmware environment. This type of flaw is classically categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command and represents a critical failure in input handling mechanisms where user-controllable data is directly concatenated into shell command strings without adequate escaping or parameterization.
The operational impact of this vulnerability is severe due to its remote exploitability, meaning that no physical access or local authentication is required for an attacker to initiate the attack vector. By exploiting this flaw, a malicious actor can achieve arbitrary code execution on the target device, potentially leading to full system compromise. In the context of industrial IoT environments where these gateways serve as critical bridges between field devices and cloud backends, such a breach could result in data exfiltration, manipulation of sensor readings, disruption of operational technology processes, or use of the compromised gateway as a pivot point for lateral movement within the network. The vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell commands, allowing adversaries to execute system-level operations remotely. Given that the exploit has been publicly disclosed, automated scanning tools and threat actors are likely already attempting to leverage this weakness against unpatched devices in production environments.
Mitigation strategies must prioritize immediate remediation through firmware updates. Advantech has released version 1.2.4_20260821 which addresses the input validation flaws within the Basic Station Certificate-Deletion Handler, effectively neutralizing the command injection vector by properly sanitizing the act argument before it is processed by the system shell. Organizations operating these devices should verify their current firmware versions and apply this update as soon as possible to restore security posture. In addition to patching, network-level controls such as strict firewall rules restricting access to management interfaces and LoRaWAN configuration endpoints can provide defense-in-depth measures while updates are being deployed. It is also recommended to review audit logs for any signs of unauthorized command execution or anomalous certificate deletion activities that may indicate prior exploitation attempts before the vulnerability was patched. The vendor's prompt response and professional handling of the disclosure highlight the importance of maintaining up-to-date firmware in critical infrastructure components to minimize exposure windows during the lifecycle management of IoT devices.