CVE-2026-79698 in WISE-6610-NB
Summary
by MITRE • 09/07/2026
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The Advantech WISE-6610 series of industrial IoT gateways, including models such as the WISE-6610-NB, WISE-6610-EB, and various EL and P variants running firmware version 1.2.1_20251110 or earlier, are susceptible to a critical remote code execution vulnerability within their integrated Node-RED Library component. This specific flaw resides in the nodered_lib_apply function, which is responsible for processing user-supplied arguments related to automation actions. The core technical deficiency involves improper neutralization of special elements used in operating system commands, commonly referred to as command injection. When an attacker provides a maliciously crafted value for the act argument, the application fails to adequately sanitize or validate this input before passing it to underlying shell interpreters. This lack of rigorous input validation allows arbitrary operating system commands to be executed with the privileges of the running service, typically root or high-privilege user accounts within the industrial control environment.
From a threat modeling perspective, this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is categorized under MITRE ATT&CK technique T1059 Command and Scripting Interpreter. The ability to launch attacks remotely significantly escalates the risk profile, as it removes the need for physical access or local user interaction. Furthermore, the fact that a public exploit exists means that automated scanning tools and opportunistic attackers can easily leverage this weakness to compromise affected systems without requiring custom development of attack vectors. In an industrial context, such compromises can lead to severe operational disruptions, including unauthorized control over connected machinery, extraction of sensitive process data, or use of the compromised gateway as a pivot point for lateral movement within the corporate network.
The impact of successfully exploiting this vulnerability extends beyond simple system compromise. Industrial environments rely on high availability and integrity; therefore, remote command injection can disrupt critical monitoring and control loops. Attackers may install persistent backdoors, deploy ransomware, or manipulate sensor data to cause physical damage or safety hazards in connected industrial processes. The presence of a public exploit accelerates the window of exposure, making immediate remediation essential for organizations relying on these Advantech devices for mission-critical operations.
To mitigate this risk, it is imperative that administrators upgrade the Node-RED Library component and associated firmware to version 1.2.4_20260821 or later, which contains the necessary code fixes to properly sanitize inputs within the nodered_lib_apply function. Until patching can be performed in a maintenance window, organizations should consider network segmentation strategies to isolate these gateways from untrusted networks and restrict outbound connections where possible. Additionally, implementing strict input validation at the application layer for any custom flows or integrations that interact with Node-RED APIs can provide an additional layer of defense against similar injection attempts. The vendor has demonstrated a responsive security posture by quickly releasing this fixed version after being contacted, facilitating rapid remediation efforts across affected deployments.