Advantech disclosed two critical command injection vulnerabilities on September 7, 2026 affecting the entire WISE-6610 series — its cellular/LoRaWAN industrial IoT gateway line widely deployed for remote monitoring and control in manufacturing, utilities, and other OT environments. Both CVE-2026-79697 and CVE-2026-79698 carry a CVSS score of 9.9, and public exploit code is already available for both.

What happened

CVE-2026-79697 sits in the gateway’s Basic Station Certificate-Deletion handler, in the basicstation_apply function of the web management interface. The handler takes an act argument that selects which certificate-management action to run; the value is passed to a shell command without sanitization, so an attacker who controls act can inject arbitrary OS commands that execute with the gateway’s elevated (effectively root) privileges.

CVE-2026-79698 is the same bug class in a different handler: nodered_lib_apply, part of the gateway’s bundled Node-RED library management feature. Same story — the act argument is concatenated into a shell call instead of being validated or parameterized, giving remote command execution.

Both handlers live behind the device’s LuCI-based admin web interface (the same /cgi-bin/luci/admin/... management surface Advantech has patched command injection bugs in before, e.g. CVE-2026-2670 in the OpenVPN apply handler). That means exploitation requires reaching the management interface — either with valid admin credentials or, in the many field deployments still running factory-default or weak credentials on internet-exposed management ports, without any real barrier at all. Advantech and third-party researchers have not disclosed the specific technical prerequisites in the vector string, but the 9.9 base score and the “no user interaction, network-exploitable” classification both databases and threat-intel trackers assign it indicate these are trivial to weaponize once the admin panel is reachable.

Both flaws affect firmware 1.2.1_20251110 across the full WISE-6610 family: WISE-6610-NB, -EB, -TB, -JB, -CB, the EL-series variants (EL-NB, EL-EB, EL-TB, EL-JB, EL-CB), and the P-series (WISE-6610P-DEA, -DNA, -DTA).

Impact

The WISE-6610 is not an office router — it’s a cellular/LoRaWAN gateway purpose-built for remote and field deployments: pulling telemetry off PLCs and sensors, backhauling it over 4G, and running local automation via its embedded Node-RED runtime. That places it squarely in OT/ICS territory: water and wastewater remote terminal sites, distributed energy monitoring, agricultural and pipeline telemetry, and factory-floor data collection where cellular backhaul is used specifically because wired network access isn’t available.

A command-injection RCE on a device in that role gives an attacker root on the gateway itself, a pivot point into whatever OT/industrial network segment it bridges, and the ability to tamper with or spoof the telemetry the gateway forwards upstream — all three of which matter far more on a remote monitoring endpoint than on a typical IT asset. Because these gateways are frequently installed once and left alone at unattended remote sites, they also tend to run outdated firmware for long stretches and are disproportionately likely to still have default admin credentials in place.

Mitigation

Advantech has shipped firmware 1.2.4_20260821, which fixes both CVE-2026-79697 and CVE-2026-79698. Upgrade every WISE-6610-family device to this build or later — check all model variants listed above, since the same vulnerable handlers ship across the entire line.

Until every unit is patched:

  • Take the admin web interface off the public internet. If field devices currently expose LuCI-based management on a WAN-facing cellular IP, put them behind a VPN or a carrier private APN instead.
  • Rotate any default or weak admin credentials on these gateways now — with public exploit code available, credential-stuffing followed by a one-shot command injection is a realistic attack chain, not a theoretical one.
  • Audit your fleet for exposure: enumerate every WISE-6610 unit, its firmware version, and whether its management interface is reachable from outside the local network.
  • If you can’t patch immediately, restrict access to the management port at the network layer (cellular APN ACLs, firewall rules) as a stopgap.

Sources: CVE-2026-79697 — VulDB, CVE-2026-79698 — VulDB, CVE-2026-79697 — OffSeq Threat Radar, CVE-2026-79698 — OffSeq Threat Radar, TheHackerWire vulnerability tracker