by Kastro
Paper/Archive/CVE-2026-19188

CVE-2026-19188

Haiwell Haiwell IoT Cloud HMI Gateway — Haiwell IoT Cloud HMI Gateway OS Command Injection

EPSS 3%CVSS 10.0
critical.is priorityof 100
47
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 87.1.871 × 2017.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.

Affected

ProductAffectedFixed inSource
Haiwell IoT Cloud HMI Gateway3.40.1.123.50.1.19CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
icscert (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refen.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361refcisa.gov/news-events/ics-advisories/icsa-26-225-02refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-225-02.json