CVE-2026-2670
HighCVSS 7.2Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in an unknown function of the file /cgi-bin/luci/admin/openvpn_apply in the Background Management component. Manipulation of the argument delete_file leads to OS command injection. The attack can be executed remotely and the exploit is publicly available. The vendor released a fix in version 1.2.4_20260821.
Risk Assessment
A remote attacker can inject and execute arbitrary system commands, potentially leading to full compromise of the device and the network.
Recommendation
Immediately update Advantech WISE-6610 devices to version 1.2.4_20260821 or later to remediate the vulnerability.
Other vulnerabilities in Advantech WISE-6610
See all- CVE-2026-79698Critical
A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the nodered_lib_apply function of the Node-RED Library component. Manipulation of the argument act leads to command injection. The attack can be launched remotely and the exploit is publicly available. The vendor released a fix in version 1.2.4_20260821.
- CVE-2026-79697Critical
A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component. Manipulation of the argument act causes command injection. The attack can be initiated remotely and the exploit is publicly disclosed. The vendor released a fix in version 1.2.4_20260821.
Original NVD description (English source)
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."