EUVD-2026-58755
GHSA-xjrj-4jhg-7qmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable Socket.io endpoint with no authentication or interaction and low-complexity injection; command runs as root escaping the app to the OS (S:C) with full C/I/A loss.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.
AnalysisAI
Remote unauthenticated OS command injection in the Haiwell IoT Cloud HMI Gateway (version 3.40.1.12) lets attackers run arbitrary operating-system commands as root through the 'Net Check' function's cmdPing Socket.io event on the /setting endpoint. The CVSS 3.1 base score is 10.0 with a scope change, reflecting full compromise of the device with no authentication or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the gateway's web management interface and the ability to send a cmdPing Socket.io event to the 'Net Check' feature on the /setting endpoint - no credentials, no user interaction, and default configuration is sufficient per the CVSS vector (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Every technical signal points to maximum severity: the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) indicates network-reachable, low-complexity, unauthenticated exploitation yielding full confidentiality, integrity, and availability loss with a scope change to the host OS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the gateway's web interface connects to the Socket.io /setting endpoint and emits a cmdPing event with a ping target containing shell metacharacters (e.g. '127.0.0.1; <command>'). … |
| Remediation | Consult the Haiwell vendor advisory and the CISA ICS advisory ICSA-26-225-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-02) for the remediated firmware/software release and apply it; the input data does not specify an exact fixed version, so no vendor-released patched version is independently confirmed at time of analysis - verify the fix build directly with Haiwell before relying on it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct immediate inventory of all Haiwell HMI Gateway 3.40.1.12 deployments; isolate affected systems from production networks or restrict access via firewall rules to trusted administration networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today