CVE-2026-19188

CriticalCVSS 10.0

Published: 14/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Summary

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the OS, allowing arbitrary command execution with root privileges.

Risk Assessment

An attacker can remotely execute commands with root privileges, leading to full device compromise.

Recommendation

Apply vendor patches or restrict access to the /setting endpoint.

Original NVD description (English source)

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.