CVE-2026-19188: Haiwell HMI Gateway Flaw Lets Attackers Execute Arbitrary OS Commands With Root Privileges (CVSS 10.0)

TL;DR

A critical Haiwell HMI Gateway flaw threatens industrial control systems worldwide. Specifically, this vulnerability allows unauthenticated attackers to execute commands directly on the host device. Vendors have quickly released a patch to secure affected units.

Why It Matters

The flaw earned a maximum CVSS score of 10.0. Therefore, it poses an extreme risk to connected infrastructure. Facilities across the Energy, Critical Manufacturing, and Water and Wastewater sectors actively use these devices. These installations often manage highly sensitive physical processes. Consequently, a successful attack could severely disrupt vital global services. According to CISA, “Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges.”

How the Attack Works

The vulnerability exists within the Net Check feature of the device. Users normally access this diagnostic tool via the /setting endpoint. However, the internal cmdPing Socket.io event fails to properly sanitize user-supplied input. Because of this oversight, the application blindly passes malicious input directly to the operating system. As a result, hackers can easily append and inject raw commands. The system then executes these commands natively.

Affected Versions

This vulnerability impacts Haiwell IoT Cloud HMI Gateway version 3.40.1.12. Currently, researchers have not observed active attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. Regardless, administrators must act quickly.

Patch and Mitigation Steps

Haiwell has released a firmware update to resolve the problem. Users should immediately download patch version Scada-v3.50.1.19 from the official vendor website. In the meantime, defenders must minimize network exposure for all control system devices. Keep these gateways completely disconnected from the public internet. Furthermore, locate control system networks securely behind strong firewalls. When remote access remains strictly required, use verified virtual private networks. However, remember that VPNs also require regular patching to remain secure.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.