Description

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-14T19:17:17.480Z",
  "pubdate": "2026-08-14T19:17:17.480Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified within the Haiwell IoT Cloud HMI Gateway product. The security defect specifically resides in the Net Check feature, which is accessible via the /setting endpoint. The underlying vulnerability stems from the improper sanitization of user-supplied input handled by the cmdPing Socket.io event before it is passed to the underlying operating system shell for execution. Successful exploitation of this flaw allows a remote attacker to inject and execute arbitrary operating system commands with root privileges. This grants complete system compromise, enabling malicious actors to manipulate network traffic, deploy persistent backdoors, access sensitive configuration files, or pivot deeper into connected industrial or enterprise networks. The risk implications are severe given that HMI gateways often reside at the boundary between IT and OT environments, potentially exposing critical infrastructure to full administrative takeover. Exploitation requires network access to the target application endpoint and the ability to interact with the vulnerable Socket.io event interface, highlighting a critical failure in input validation and secure IPC mechanisms.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located in the Net Check feature of the Haiwell IoT Cloud HMI Gateway product. The affected surface is exposed through the /setting endpoint, which processes real-time bidirectional communication via the Socket.io protocol. Specifically, the vulnerable component is invoked through the cmdPing Socket.io event handler. The root cause of the vulnerability is the absolute lack of input validation, sanitization, or contextual escaping of user-supplied parameters before they are concatenated or passed directly into an operating system execution sink, such as a shell invocation function (e.g., system(), popen(), or equivalent process execution primitives).\nThe attack flow proceeds as follows: First, an unauthenticated or remotely positioned network attacker establishes communication with the target Haiwell IoT Cloud HMI Gateway instance, specifically targeting the /setting endpoint where the Socket.io service listens for client connections. Second, the attacker crafts a malicious payload containing shell metacharacters (such as semicolons, pipe symbols, backticks, or logical operators) appended to or replacing the expected target IP address or hostname parameter within the payload of the cmdPing Socket.io event. Third, the application receives the malicious Socket.io event and extracts the unsanitized parameter. Fourth, the application passes this raw string directly to the underlying operating system command interpreter. Fifth, the command interpreter parses the injected metacharacters and executes the attacker-supplied payload alongside or instead of the intended ping utility.\nBecause the affected application typically runs with highest-level administrative privileges, the injected commands are executed with root privileges. Post-exploitation impact includes unrestricted read and write access to the underlying filesystem, execution of arbitrary binaries, manipulation of system services, interception of network traffic, and potential lateral movement across connected network segments. The network exposure includes accessibility via standard HTTP/HTTPS and WebSocket/Socket.io transport protocols bound to the /setting endpoint."
}