Description

A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-07T07:16:45.903Z",
  "pubdate": "2026-09-07T07:16:45.903Z",
  "executiveSummary": "A critical command injection vulnerability exists within the Basic Station Certificate-Deletion Handler of various Advantech WISE-6610 and WISE-6610P series gateways running firmware version 1.2.1_20251110. The vulnerability stems from improper sanitization of the 'act' argument within the 'basicstation_apply' function, allowing an attacker to execute arbitrary system commands.\nSuccessful exploitation of this flaw can lead to full system compromise, as commands are processed with elevated privileges. The vulnerability is remotely exploitable, posing a significant risk to industrial IoT deployments. Because the exploit has been publicly disclosed, the potential for malicious utilization is high. Organizations must urgently upgrade to firmware version 1.2.4_20260821 to remediate this security risk.",
  "technicalDetails": "The vulnerability resides in the 'basicstation_apply' function, which is a component of the Basic Station Certificate-Deletion Handler in Advantech WISE-6610 and WISE-6610P series devices. The function fails to perform adequate input validation or sanitization on the 'act' parameter before passing it to an underlying system shell or execution environment.\nThe root cause is an insecure implementation where user-supplied input is concatenated directly into a system command string. By manipulating the 'act' argument during a certificate deletion request, an attacker can escape the intended command context using shell metacharacters such as backticks, semicolons, or pipe operators. This allows the injection of arbitrary malicious commands that will be executed by the gateway's operating system with the privileges of the 'basicstation_apply' process.\nThe attack flow proceeds as follows: An attacker sends a crafted network request (specifically targeting the certificate-deletion workflow) containing a malicious payload embedded within the 'act' argument. Upon receiving the request, the 'basicstation_apply' function fails to filter the payload and proceeds to execute the constructed command string. The operating system interprets the injected characters as part of the command, thereby executing the attacker's instructions.\nThis vulnerability is remotely exploitable, meaning the attacker does not require physical access to the device or local network segment, provided the management interface is exposed. The exploitation does not necessarily require complex heap grooming or memory corruption techniques, as it is a direct result of improper command construction. Post-exploitation, an attacker can gain persistent access to the gateway, intercept sensitive data, pivot into protected OT networks, or disable security-critical functions. The affected firmware version is 1.2.1_20251110, covering multiple models including WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA, and WISE-6610P-DTA."
}