EUVD-2026-58755
GHSA-xjrj-4jhg-7qmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach gateway web interface
-
DeliveryConnect to /setting Socket.io endpoint
-
ExploitEmit cmdPing with shell metacharacters
-
ExecutionInject into unsanitized ping command
-
PersistExecute arbitrary commands as root
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the gateway's web management interface and the ability to send a cmdPing Socket.io event to the 'Net Check' feature on the /setting endpoint - no credentials, no user interaction, and default configuration is sufficient per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is exposure of that management interface: since this is an OT/HMI gateway that is typically deployed inside segmented industrial networks, exploitation depends on the attacker having a network path to the device (direct internet exposure, a compromised host on the same segment, or flat network design). Confirmed affected version is 3.40.1.12; other versions are not confirmed. |
| Impact | Every technical signal points to maximum severity: the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) indicates network-reachable, low-complexity, unauthenticated exploitation yielding full confidentiality, integrity, and availability loss with a scope change to the host OS. It was reported by CISA ICS-CERT (icscert) and carries a dedicated ICS advisory, which raises confidence in the finding, though it is not currently listed in CISA KEV and no EPSS score was supplied, so quantitative exploitation probability is unknown and there is no evidence of active in-the-wild use yet. The primary caveat is exposure: HMI/OT gateways should not be internet-facing, so real-world reachability depends heavily on whether the /setting interface is exposed beyond a segmented OT network - an internet-exposed instance is critical, while a properly segmented one is far lower risk. Given root-level command execution with no authentication, any operator running the affected version - from a large utility to a small municipal or industrial deployment - should treat this as urgent and prioritize patching or isolating the device. |
| Exploit ScenarioDerived | An attacker who can reach the gateway's web interface connects to the Socket.io /setting endpoint and emits a cmdPing event with a ping target containing shell metacharacters (e.g. '127.0.0.1; <command>'). Because the input is passed unsanitized to a shell running as root and no authentication is required, the injected command executes immediately with full privileges. No public exploit code has been identified, but the low attack complexity makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 14, 2026
Remote unauthenticated OS command injection in the Haiwell IoT Cloud HMI Gateway (version 3.40.1.12) lets attackers run arbitrary operating-system commands as root through the 'Net Check' function's cmdPing Socket.io event on the /setting endpoint. The CVSS 3.1 base score is 10.0 with a scope change, reflecting full compromise of the device with no authentication or user interaction. No public exploit has been identified at time of analysis, and the flaw is documented in CISA ICS advisory ICSA-26-225-02.
RemediationAI
Consult the Haiwell vendor advisory and the CISA ICS advisory ICSA-26-225-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-02) for the remediated firmware/software release and apply it; the input data does not specify an exact fixed version, so no vendor-released patched version is independently confirmed at time of analysis - verify the fix build directly with Haiwell before relying on it. Until a confirmed patch is applied, the highest-value compensating control is network isolation: place the gateway behind a firewall and remove any internet exposure, restricting access to the management/web interface (and the Socket.io /setting endpoint) to a trusted OT management VLAN or jump host, which prevents remote reach at the cost of requiring on-network access for legitimate administration. Where feasible, disable or block access to the 'Net Check'/cmdPing diagnostic function and use VPN-gated access for remote maintenance; the trade-off is loss of the built-in network-test convenience. Follow CISA ICS defensive practices for OT segmentation and minimize the device's network exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is an industrial HMI/IoT cloud gateway that exposes a web management interface using Socket.io (a WebSocket/long-polling event framework). The 'Net Check' diagnostic feature emits a cmdPing event whose user-supplied argument is passed to an underlying shell command (a ping-style network test) without sanitization. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue: shell metacharacters such as ';', '|', '&&', or backticks in the ping target break out of the intended command and execute attacker-chosen commands. Because the gateway service runs as root, injected commands inherit root privileges. Only one CPE is enumerated - cpe:2.3:a:haiwell:haiwell_iot_cloud_hmi_gateway - with confirmed impact on version 3.40.1.12.
Know when Haiwell Iot Cloud Hmi Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Network-reachable Socket.io endpoint with no authentication or interaction and low-complexity injection; command runs as root escaping the app to the OS (S:C) with full C/I/A loss.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
DescriptionCVE.org
A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.
Executive ViewAI
Haiwell IoT Cloud HMI Gateway (v3.40.1.12) contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary OS commands as root, creating immediate risk to industrial control systems and operational technology infrastructure. No patch is currently available, requiring urgent interim containment and risk mitigation.
Until vendor patch availability: (1) Implement network segmentation restricting access to HMI Gateway /setting endpoint to authorized administration networks only; (2) Deploy intrusion detection/prevention rules targeting cmdPing Socket.io event patterns; (3) Implement request filtering on /setting endpoint; (4) Monitor system and access logs for suspicious command execution; (5) Consider air-gapping critical affected systems if operationally feasible; (6) Establish baseline monitoring for indicators of compromise including unauthorized root-level commands and unexpected process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB