Which versions of Advantech WISE-6610 are affected by CVE-2026-79698?

Advantech WISE-6610 industrial IoT gateways contain a remotely exploitable command execution vulnerability (CVSS 8.6) affecting all thirteen firmware variants currently at version 1.2.1_20251110.. A patch is available.

Is there a public PoC exploit available for CVE-2026-79698?

Yes, a public proof-of-concept exploit is available for CVE-2026-79698. Prioritise patching immediately. EPSS: 1.7%.

How to fix or mitigate CVE-2026-79698?

Within 24 hours, conduct a complete inventory of all Advantech WISE-6610 devices in your environment, identify those running firmware 1.2.1_20251110 or earlier, document their operational criticality and network connectivity, and implement network access restrictions to administrative interfaces where operationally feasible. Within 7 days, obtain firmware version 1.2.4_20260821, validate it in a staging environment that replicates your WISE-6610 configuration and Node-RED applications, confirm backward compatibility, and develop a staged deployment schedule prioritizing critical infrastructure and production systems. Within 30 days, complete firmware upgrades to version 1.2.4_20260821 on all identified affected systems, perform post-upgrade validation and functionality testing, and verify patch compliance through firmware version audits.

Advantech WISE-6610 CVE-2026-79698

Q: What is the CVSS score of CVE-2026-79698?

CVE-2026-79698 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.7%.

EUVD-2026-72264 HIGH

Command Injection (CWE-77)

2026-09-07 VulDB

GHSA-jv2h-v536-h99j

Command Injection Wise 6610 Nb Wise 6610 Eb Wise 6610 Tb Wise 6610 Jb Wise 6610 Cb Wise 6610 El Nb Wise 6610 El Eb Wise 6610 El Tb Wise 6610 El Jb Wise 6610 El Cb Wise 6610P Dea Wise 6610P Dna Wise 6610P Dta Advantech

8.6

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.6 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable command injection requires only low-privilege auth; scope changes to OS beyond Node-RED application boundary, justifying S:C.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 07, 2026 - 10:33 vuln.today

Analysis Updated

Sep 07, 2026 - 07:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 07, 2026 - 07:22 vuln.today

cvss_changed

Severity Changed

Sep 07, 2026 - 07:22 NVD

CRITICAL HIGH

CVSS changed

Sep 07, 2026 - 07:22 NVD

9.4 (CRITICAL) 8.6 (HIGH)

Analysis Generated

Sep 07, 2026 - 07:06 vuln.today

CVE Published

Sep 07, 2026 - 06:30 cve.org

CRITICAL 9.4

DescriptionCVE.org

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Command injection in Advantech WISE-6610 series industrial IoT gateways allows a remotely authenticated attacker with low privileges to execute arbitrary OS commands via the Node-RED Library's nodered_lib_apply function. All thirteen WISE-6610 firmware variants at version 1.2.1_20251110 are confirmed affected, and a public exploit is available. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid low-privilege account on the WISE-6610 Node-RED web interface (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with all-High impact scores) places this at 8.6, reflecting a low-complexity, network-reachable attack requiring only a low-privilege account - consistent with how Node-RED authentication typically works on these gateways. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade all affected WISE-6610 firmware to version 1.2.4_20260821, available from the Advantech firmware portal at https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a complete inventory of all Advantech WISE-6610 devices in your environment, identify those running firmware 1.2.1_20251110 or earlier, document their operational criticality and network connectivity, and implement network access restrictions to administrative interfaces where operationally feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.