Vulnerability details

CVE-2026-79698

Advantech WISE-6610-CBAdvantech WISE-6610-EBAdvantech WISE-6610-EL-CBAdvantech WISE-6610-EL-EBAdvantech WISE-6610-EL-JBAdvantech WISE-6610-EL-NB

Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection

CVSS 4.0

9.4Critical

Official description

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS scores

Score	Version	Source	Vector
9.4Critical	4.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P`
9.9Critical	3.1	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C`
9.9Critical	3.0	CVEProject cvelistV5 (CNA) (VulDB)	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C`
9.0High	2.0	CVEProject cvelistV5 (CNA) (VulDB)	`AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C`

Affected products

Vendor	Product	Versions	Source
Advantech	WISE-6610-CB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610-EB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610-EL-CB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610-EL-EB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610-EL-JB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610-EL-NB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610-EL-TB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610-JB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610-NB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610-TB	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610P-DEA	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610P-DNA	1.2.1_20251110	CVEProject cvelistV5 (CNA)
Advantech	WISE-6610P-DTA	1.2.1_20251110	CVEProject cvelistV5 (CNA)

References and advisories

https://vuldb.com/vuln/399513 vdb-entrytechnical-description
https://vuldb.com/vuln/399513/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-79698 third-party-advisory
https://vuldb.com/submit/879219 third-party-advisory
https://uvxbywu62qm.feishu.cn/wiki/RgziwoXf2iD9zKkI4MJcfWcNn7c?from=from_copylink exploit
https://www.advantech.com/zh-tw/security-advisory related
https://www.advantech.com/en-us/support/details/firmware?id=1-2K7AXRI patch
https://www.advantech.com/ product

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-07
Last updated: 2026-09-12
State: Published
Assigner (CNA): VulDB

Exploit prediction (EPSS)

3.15%

Probability of exploitation in 30 days

87.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-77
Command Injection
CWE-74
Injection