Which versions of Advantech WISE-6610 are affected by CVE-2026-79697?

Advantech WISE-6610 LoRaWAN gateways (all 13 hardware variants) contain a critical command injection vulnerability in firmware 1.2.1_20251110 that enables remote attackers with low network privileges…. A patch is available.

Is there a public PoC exploit available for CVE-2026-79697?

Yes, a public proof-of-concept exploit is available for CVE-2026-79697. Prioritise patching immediately. EPSS: 3.4%.

How to fix or mitigate CVE-2026-79697?

Immediately inventory all WISE-6610 deployments and confirm current firmware versions, prioritizing identification of any systems running vulnerable firmware 1.2.1_20251110 or earlier. Within 7 days, stage firmware version 1.2.4_20260821 in a non-production environment to validate compatibility with your Certificate Handler configuration and existing uplink integrations. Within 30 days, complete migration to firmware 1.2.4_20260821 across all 13 WISE-6610 hardware variants, scheduling updates during maintenance windows for internet-facing gateways first.

Advantech WISE-6610 CVE-2026-79697

Q: What is the CVSS score of CVE-2026-79697?

CVE-2026-79697 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 3.4%.

EUVD-2026-72263 HIGH

Command Injection (CWE-77)

2026-09-07 VulDB

GHSA-xm3j-j5cf-v4fr

Command Injection Wise 6610 Nb Wise 6610 Eb Wise 6610 Tb Wise 6610 Jb Wise 6610 Cb Wise 6610 El Nb Wise 6610 El Eb Wise 6610 El Tb Wise 6610 El Jb Wise 6610 El Cb Wise 6610P Dea Wise 6610P Dna Wise 6610P Dta Advantech

8.6

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.6 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable command injection with PR:L auth; scope change (S:C) because gateway compromise affects downstream LoRaWAN sensor and OT systems, consistent with CVSS 4.0 SC:H/SI:H/SA:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 07, 2026 - 11:21 vuln.today

Analysis Updated

Sep 07, 2026 - 07:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 07, 2026 - 07:22 vuln.today

cvss_changed

Severity Changed

Sep 07, 2026 - 07:22 NVD

CRITICAL HIGH

CVSS changed

Sep 07, 2026 - 07:22 NVD

9.4 (CRITICAL) 8.6 (HIGH)

Analysis Generated

Sep 07, 2026 - 07:06 vuln.today

CVE Published

Sep 07, 2026 - 06:15 cve.org

CRITICAL 9.4

DescriptionCVE.org

A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Command injection in Advantech WISE-6610 LoRaWAN gateway firmware 1.2.1_20251110 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the act parameter in the Basic Station Certificate-Deletion Handler (basicstation_apply function). All 13 WISE-6610 hardware variants are affected, spanning NB, EB, TB, JB, CB, EL-series, and P-series models deployed in industrial IoT environments. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires low-privilege authenticated access to the WISE-6610 web management interface, confirmed by the CVSS 4.0 PR:L metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects a high-severity network-exploitable command injection with full impact on both the vulnerable gateway and downstream systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade all affected WISE-6610 devices to firmware version 1.2.4_20260821, available from Advantech's firmware support portal at https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Immediately inventory all WISE-6610 deployments and confirm current firmware versions, prioritizing identification of any systems running vulnerable firmware 1.2.1_20251110 or earlier. …

Threat intelligence, references, and detailed analysis are available after sign-in.