Haiwell IoT Cloud HMI Gateway: 1 CVE, Critical 10.0
Summary
CISA reports 1 vulnerability in Haiwell Haiwell IoT Cloud HMI Gateway. Weakness type: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges. Highest CVSS v3 score: 10.0 (Critical), exploitable over the network.
At a glance
- Vendor
- Haiwell
- Products
- Haiwell IoT Cloud HMI Gateway
- CVEs
- CVE-2026-19188
- Highest CVSS v3
- 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy, Critical Manufacturing, Water and Wastewater
- Deployed
- Worldwide
- Vendor HQ
- China
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-19188 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 10.0 | – | No | A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with r… |
Affected products (1)
- Haiwell Haiwell IoT Cloud HMI Gateway: 3.40.1.12
Vendor fixes and mitigations (from advisory)
- Mitigation: Haiwell has addressed the issue in patch version number Scada-v3.50.1.19, which is available for download on their website: https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361 link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.