OS Command Injection Vulnerability in Haiwell IoT Cloud HMI Gateway
CVE-2026-19188

10CRITICAL

Key Information:

Vendor

Haiwell

Status
Haiwell Iot Cloud Hmi Gateway
Vendor
CVE Published:
14 August 2026

What is CVE-2026-19188?

A significant OS command injection vulnerability has been discovered in the Haiwell IoT Cloud HMI Gateway, specifically within the Net Check feature found at the /setting endpoint. This vulnerability allows attackers to exploit the cmdPing Socket.io event due to improper sanitization of user-supplied input. As a result, malicious actors can inject and execute arbitrary commands at the operating system level with root privileges, posing a severe risk to device integrity and security.

Affected Version(s)

Haiwell IoT Cloud HMI Gateway 3.40.1.12

Haiwell IoT Cloud HMI Gateway 3.50.1.19

References

https://en.haiwell.com/app/system/entrance.php?m=include&...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fiqram Akmal reported this vulnerability to CISA.
.