Advantech WISE-6610-NB 1.2.1_20251110 Background Management openvpn_apply delete_file os command injection

Summaryinfo

A vulnerability identified as critical has been detected in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Performing a manipulation of the argument delete_file results in os command injection. This vulnerability is reported as CVE-2026-2670. The attack is possible to be carried out remotely. Moreover, an exploit is present. You should upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."

Detailsinfo

A vulnerability, which was classified as critical, was found in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects some unknown functionality of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. The manipulation of the argument delete_file with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-2670. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are required for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."

Upgrading to version 1.2.4_20260821 eliminates this vulnerability. The upgrade is hosted for download at advantech.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Advantech

Name

• WISE-6610-CB
• WISE-6610-EB
• WISE-6610-EL-CB
• WISE-6610-EL-EB
• WISE-6610-EL-JB
• WISE-6610-EL-NB
• WISE-6610-EL-TB
• WISE-6610-JB
• WISE-6610-NB
• WISE-6610-TB
• WISE-6610P-DEA
• WISE-6610P-DNA
• WISE-6610P-DTA

Version

• 1.2.1_20251110

License

• commercial

Website

• Vendor: https://www.advantech.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #753293: Advantech WISE-6610 v1.2.1_20251110 OS Command Injection (by jiefengliang)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion