11
CVEs
2
Critical
7
High
0
KEV
2
PoC
5
Unpatched C/H
36.4%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
7
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Webaccess
94
R Seenet
40
Advantech Webaccess
38
Iview
36
Webaccess Scada
30
Eki 6333Ac 2G Firmware
20
Eki 6333Ac 2Gd Firmware
20
Eki 6333Ac 1Gpo Firmware
20
Webaccess Nms
20
Webaccess Hmi Designer
18
Webaccess Vpn
12
Webaccess Dashboard
11
Wise Deviceon Server
11
PHP
8
Wise 4050lan Firmware
8
Wise 4010lan Firmware
8
Wise 4060lan Firmware
8
Eki 1524 Firmware
5
Eki 1522 Firmware
5
Eki 1521 Firmware
5
Wise Paas Rmm
5
Adam 3600 Edgelink
5
Deviceon Iedge
4
Adam 5630 Firmware
3
Susiaccess
3
Wise 6610 Jb
2
Wise 6610 El Cb
2
Wise 6610P Dna
2
Iot Edge Linux Docker
2
Wise 6610 El Eb
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-79697 | Command injection in Advantech WISE-6610 LoRaWAN gateway firmware 1.2.1_20251110 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the act parameter in the Basic Station Certificate-Deletion Handler (basicstation_apply function). All 13 WISE-6610 hardware variants are affected, spanning NB, EB, TB, JB, CB, EL-series, and P-series models deployed in industrial IoT environments. A public proof-of-concept exploit has been disclosed; upgrading to firmware 1.2.4_20260821 resolves the issue. | HIGH | 8.6 | 3.4% | 66 |
PoC
|
| CVE-2026-79698 | Command injection in Advantech WISE-6610 series industrial IoT gateways allows a remotely authenticated attacker with low privileges to execute arbitrary OS commands via the Node-RED Library's nodered_lib_apply function. All thirteen WISE-6610 firmware variants at version 1.2.1_20251110 are confirmed affected, and a public exploit is available. Advantech has released firmware 1.2.4_20260821 as the fix, with no active exploitation (CISA KEV) confirmed at time of analysis. | HIGH | 8.6 | 1.7% | 65 |
PoC
|
| CVE-2026-43830 | Command injection in Advantech ADAM-3600 EdgeLink RTU controllers (versions prior to 2.8.5.1) lets remote attackers execute arbitrary operating-system commands by abusing the firmware upgrade file verification routine. The device fails to sanitize input consumed while validating an uploaded firmware image, so crafted content is passed to a shell context. No public exploit identified at time of analysis, and the EPSS score is low (0.14%), but the CVSS 9.8 rating and the device's role as an industrial edge controller make this a high-value target. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-14162 | Sensitive data exposure in Advantech Hospital Queuing Management lets unauthenticated remote attackers reach a specific URL and retrieve the application's API documentation, mapping out endpoints and parameters without any credentials. The flaw is rooted in missing authentication (CWE-306) on a resource that should be protected, and TWCERT rates it CVSS 4.0 9.3 (Critical). No public exploit is identified at time of analysis, but the exposed API documentation provides reconnaissance that materially lowers the barrier to follow-on attacks. | CRITICAL | 9.3 | 0.5% | 46 |
|
| CVE-2026-14161 | Information disclosure in Advantech Hospital Queuing Management allows unauthenticated remote attackers to retrieve internal API documentation by requesting a specific URL, exposing the application's API surface, endpoints, and parameters. The flaw carries a high CVSS 4.0 base score of 8.7 driven entirely by confidentiality impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The leaked documentation primarily serves as reconnaissance that lowers the barrier to attacking other endpoints of this healthcare queuing platform. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-43832 | Remote code execution via stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's Cookie parsing logic affects all firmware versions prior to 2.8.5.1, exploitable by unauthenticated network attackers when the SafeEnhancement feature is enabled. The vulnerability (CWE-121) allows arbitrary code execution on the edge controller, an OT/IIoT device typically deployed in industrial automation environments. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the industrial attack surface warrants heightened concern due to the operational consequences of device compromise. Notably, the provided CVSS vector (C:H/I:N/A:N) is inconsistent with the described code execution impact - a discrepancy that should be verified with the vendor. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-43829 | Stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's password handling routine enables unauthenticated remote code execution when the SafeEnhancement feature is active. All firmware versions prior to 2.8.5.1 are affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface on an industrial IoT edge device warrants prompt patching given OT environment exposure. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-43831 | Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge controllers is possible through a stack-based buffer overflow in the device's log message handling functionality, exploitable by unauthenticated network attackers on versions prior to 2.8.5.1. Reported by the Cyber Security Agency of Singapore (CSA), the vulnerability carries a CWE-121 classification - a well-understood root cause class with a history of weaponizable exploits, particularly in embedded and OT/ICS devices. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the network-accessible, unauthenticated nature of the flaw and the industrial deployment context elevate operational risk above what the percentile alone suggests. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-6890 | Default-credential unauthorized access affects the Advantech ECU-1251D industrial communication gateway, which ships with a root SSH account protected by no password and is documented as such in the device manual. An attacker on the same network segment can log in as root over SSH without any credential, and because configuration provides no prompt or guidance to change these defaults, exploitable devices are likely to persist in the field. No public exploit identified at time of analysis, but the vulnerability requires no exploitation skill - knowledge of the documented default is sufficient. | HIGH | 7.1 | – | 36 |
No patch
|
| CVE-2026-6889 | Denial of service in the Advantech ECU-1251D industrial communication gateway allows a network-adjacent, high-privilege attacker to send a crafted DNP3 signal to the device's Digital Output address, forcing the DNP3Daemon into an indefinite restart loop and severing SCADA TelWin operator connectivity until a manual restart is performed. The device remains partially reachable via its web panel during the loop, which may create a false impression of operational continuity while SCADA control is lost. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the disclosure source is Singapore's Cyber Security Agency (CSA). | MEDIUM | 6.9 | – | 34 |
No patch
|
| CVE-2026-43833 | Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overflow a fixed-size stack buffer in the device's file-upload functionality and execute arbitrary code on the controller. The flaw affects all versions listed in the CSA advisory (AL-2026-097) and, given the device's role in OT/SCADA data acquisition, a successful exploit yields full control of an industrial edge node. No public exploit has been identified at time of analysis, and high attack complexity plus a high-privilege requirement temper the network-facing CVSS 4.0 base score of 7.5. | MEDIUM | 5.3 | 0.1% | 27 |
No patch
|