Skip to main content

Advantech WISE-6610 EUVDEUVD-2026-72263

| CVE-2026-79697 HIGH
Command Injection (CWE-77)
2026-09-07 VulDB GHSA-xm3j-j5cf-v4fr
Command Injection Wise 6610 Nb Wise 6610 Eb Wise 6610 Tb Wise 6610 Jb Wise 6610 Cb Wise 6610 El Nb Wise 6610 El Eb Wise 6610 El Tb Wise 6610 El Jb Wise 6610 El Cb Wise 6610P Dea Wise 6610P Dna Wise 6610P Dta Advantech
8.6
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
8.6 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network-reachable command injection with PR:L auth; scope change (S:C) because gateway compromise affects downstream LoRaWAN sensor and OT systems, consistent with CVSS 4.0 SC:H/SI:H/SA:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
POC Analysis Generated
Sep 07, 2026 - 11:21 vuln.today
Analysis Updated
Sep 07, 2026 - 07:31 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 07, 2026 - 07:22 vuln.today
cvss_changed
Severity Changed
Sep 07, 2026 - 07:22 NVD
CRITICAL HIGH
CVSS changed
Sep 07, 2026 - 07:22 NVD
9.4 (CRITICAL) 8.6 (HIGH)
Analysis Generated
Sep 07, 2026 - 07:06 vuln.today
CVE Published
Sep 07, 2026 - 06:15 cve.org
CRITICAL 9.4

DescriptionCVE.org

A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Command injection in Advantech WISE-6610 LoRaWAN gateway firmware 1.2.1_20251110 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the act parameter in the Basic Station Certificate-Deletion Handler (basicstation_apply function). All 13 WISE-6610 hardware variants are affected, spanning NB, EB, TB, JB, CB, EL-series, and P-series models deployed in industrial IoT environments. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires low-privilege authenticated access to the WISE-6610 web management interface, confirmed by the CVSS 4.0 PR:L metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects a high-severity network-exploitable command injection with full impact on both the vulnerable gateway and downstream systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade all affected WISE-6610 devices to firmware version 1.2.4_20260821, available from Advantech's firmware support portal at https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Immediately inventory all WISE-6610 deployments and confirm current firmware versions, prioritizing identification of any systems running vulnerable firmware 1.2.1_20251110 or earlier. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wise 6610 Nb

View all
CVE-2026-79698 HIGH POC
8.6 Sep 07

Command injection in Advantech WISE-6610 series industrial IoT gateways allows a remotely authenticated attacker with lo

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

EUVD-2026-72263 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy