WISE-6610-EL-TB (<= 1.2.1_20251110) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wise-6610-el-tb--1.2.1_20251110/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 07 Sep 2026 08:51:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCritical Command Injection Vulnerability in Advantech WISE-6610 Gateways (CVE-2026-79697)https://feed.craftedsignal.io/briefs/2026-09-cve-2026-79697/Mon, 07 Sep 2026 08:51:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-79697/Advantech WISE-6610 series gateways are vulnerable to unauthenticated remote command injection via the Basic Station Certificate-Deletion Handler, potentially leading to full system compromise.CVE-2026-79697 is a critical remote command injection vulnerability affecting multiple models within the Advantech WISE-6610 series of industrial IoT gateways running firmware version 1.2.1_20251110. The vulnerability resides within the 'basicstation_apply' function of the Basic Station Certificate-Deletion Handler component. By sending a maliciously crafted request that manipulates the 'act' argument, an unauthenticated remote attacker can achieve arbitrary command execution on the underlying operating system of the gateway. The exploit for this vulnerability is publicly disclosed, increasing the risk of exploitation for exposed devices. Defenders should prioritize patching, as this gateway series is often used in sensitive industrial environments where persistent access could lead to lateral movement or operational disruption.

Impact

Successful exploitation allows for full system compromise of the affected WISE-6610 gateway, which may grant an attacker a persistent foothold within the industrial network. Given the role of these devices as IoT gateways, an attacker could potentially intercept, modify, or disrupt communications between field sensors and backend control systems. There are no specific victim counts provided, but the severity of a 9.9 CVSS score and the public availability of the exploit necessitates immediate remediation for all internet-facing instances of this hardware.

Recommendation

  1. Upgrade all affected WISE-6610 series devices to firmware version 1.2.4_20260821 immediately to mitigate the underlying command injection vector.
  2. Implement strict firewall controls to prevent unauthorized remote access to the web-based administrative interface of these gateways.
  3. Audit network traffic for unusual outbound connections originating from WISE-6610 devices, which may indicate successful exploitation and subsequent command-and-control activity.
]]>criticaladvisoryiotvulnerabilitycvenetwork-security