Overview
A critical OS command injection vulnerability has been disclosed in the Advantech WISE-6610 series of industrial cellular/IoT gateways. Tracked as CVE-2026-79697 and rated 9.9 (Critical) on the CVSS scale, the flaw resides in the device's Basic Station certificate-deletion handler and allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the gateway.
A public exploit for the vulnerability is already available, meaning organizations running affected firmware should treat this as an active, weaponizable threat rather than a theoretical risk.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-79697 |
| Severity | Critical (CVSS 9.9) |
| CWE | CWE-77 — Improper Neutralization of Special Elements used in a Command |
| Attack Vector | Network |
| Authentication | None Required |
| Public Exploit | Available |
| Affected Firmware | 1.2.1_20251110 and earlier |
| Fixed Firmware | 1.2.4_20260821 |
How It Works
The vulnerability lives in the basicstation_apply function, part of the device's Basic Station certificate-deletion handler. The function passes the act argument through to a system-level call without adequate sanitization, allowing an attacker to append or substitute shell metacharacters and inject arbitrary commands. Because the handler is reachable without authentication, an attacker only needs network access to the device's management interface to exploit it.
Successful exploitation grants command execution in the context of the gateway's underlying OS, which on these embedded Linux-based devices typically means full administrative control of the unit.
Affected Products
The advisory covers the full WISE-6610 industrial gateway line running firmware 1.2.1_20251110 or earlier:
- WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB
- WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB
- WISE-6610P-DEA, WISE-6610P-DNA, WISE-6610P-DTA
These gateways are commonly deployed for cellular/LoRaWAN connectivity in industrial, utility, and building-automation environments — settings where a compromised gateway can serve as a pivot point into operational technology (OT) networks.
Note: a related command injection issue, CVE-2026-79698, was disclosed the same day in a different handler on the same product line — patch for both.
Impact Assessment
Who Is At Risk
- Any WISE-6610-series gateway with its management interface reachable from an untrusted network, including the public internet
- Multi-site industrial deployments where gateways are centrally managed but individually internet-facing
- Environments where the gateway bridges cellular/WAN connectivity into an internal OT or SCADA segment
Potential Attack Chains
- Initial Access — Attacker sends a crafted request to the Basic Station certificate-deletion handler, injecting a command via the
actparameter - Command Execution — Injected command runs in the gateway's OS context, typically with elevated local privileges
- Persistence — Attacker plants a backdoor or modifies gateway configuration/firmware to survive reboots
- Lateral Movement — Gateway is used as a foothold to reach connected OT/industrial control systems or internal networks
Mitigation
Immediate Actions
- Patch immediately — upgrade to firmware 1.2.4_20260821, which Advantech has confirmed resolves the issue
- Remove internet exposure — the management interface should never be reachable directly from the public internet; place gateways behind a VPN or jump host
- Restrict network access — allow-list management access to known administrative IP ranges only
- Segment OT networks — ensure a compromised gateway cannot directly reach critical control systems
Detection Opportunities
- Unexpected outbound connections or shell processes spawned from the gateway's management service
- Unusual or malformed requests targeting the Basic Station / certificate-deletion endpoint
- Unplanned configuration or firmware changes on WISE-6610 devices
- New or modified cron jobs, startup scripts, or binaries on the device filesystem
Defence-in-Depth
- Maintain an inventory of all Advantech WISE-6610 deployments and their firmware versions
- Enforce network segmentation between IIoT gateways and business/OT networks
- Monitor vendor advisories for related CVEs (e.g., CVE-2026-79698) affecting the same product line
- Where patching cannot happen immediately, disable or firewall the affected management functionality as a compensating control
Background
Industrial IoT gateways like the WISE-6610 series sit at the boundary between cellular/WAN connectivity and internal operational networks, making them attractive targets for attackers seeking to pivot into ICS/OT environments. A CVSS 9.9, pre-authentication, remotely exploitable command injection with a public exploit already circulating represents an urgent patching priority for any organization running these devices.