LiveActive security incident?Get immediate response
CVE Record

CVE-2026-19188: Haiwell IoT Cloud HMI Gateway OS Command Injection

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Haiwell IoT Cloud HMI Gateway versions 3.40.1.12 and 3.50.1.19 contain a remotely reachable flaw that can let an unauthenticated attacker run operating-system commands as root. Successful exploitation could expose sensitive information, alter gateway behavior, disrupt availability, and potentially affect connected operational processes.

Executive priority

Immediate. Determine within the shortest operationally safe window whether affected gateways exist and are remotely reachable. Isolate exposed systems first, then obtain confirmed vendor remediation. Because exploitation could grant root control over an industrial gateway, suspected compromise should trigger incident response and assessment of connected operational systems.

Technical view

The /setting Net Check feature handles the cmdPing Socket.io event without adequately sanitizing user input before passing it to the operating system. This is OS command injection (CWE-78). The CVSS 3.1 score is 10.0, reflecting network access, low complexity, no required privileges or user interaction, root-level impact, and changed scope.

Likely exposure

Exposure is highest where an affected gateway's management interface or Socket.io service is reachable from the internet, untrusted networks, or compromised internal systems. The supplied record identifies only versions 3.40.1.12 and 3.50.1.19 as affected; do not assume other versions are vulnerable without vendor confirmation.

Exploitation context

The source bundle does not establish active exploitation, and CVE-2026-19188 is not identified as a CISA Known Exploited Vulnerability. However, its unauthenticated network attack path, low complexity, and root-level command execution make exposed affected devices urgent targets for defensive review.

Researcher notes

The vulnerable path is described as cmdPing processing within the Net Check feature at /setting. Input reaches an OS command context without sufficient sanitization and executes with root privileges. The supplied sources do not provide a confirmed fixed version, detailed mitigation, or evidence of exploitation; testing should remain authorized and non-disruptive.

Mitigation direction

  • Identify and prioritize gateways running versions 3.40.1.12 or 3.50.1.19.
  • Block internet and untrusted-network access to affected management interfaces.
  • Restrict gateway administration to trusted management hosts and segmented networks.
  • Disable the Net Check feature if supported and operationally acceptable.
  • Consult Haiwell and CISA guidance for confirmed remediation or updated firmware.
  • Treat potentially compromised gateways as high-risk assets requiring incident response review.

Validation and detection

  • Inventory Haiwell IoT Cloud HMI Gateways and record their exact firmware versions.
  • Verify whether /setting and Socket.io services are reachable from untrusted network segments.
  • Review gateway and surrounding network logs for unusual cmdPing activity.
  • Check for unexpected root processes, configuration changes, accounts, or outbound connections.
  • Confirm applied firmware or mitigations against current Haiwell and CISA guidance.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-78: Command execution behavior lookup

Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-19188 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96icscert
10CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——icscert

Vulnerability scoring details

Base CVSS 4.0 score

10Critical
CVSS 4.0 vector shape for CVE-2026-19188Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
HaiwellHaiwell IoT Cloud HMI Gateway3.40.1.12, 3.50.1.19unaffected
Weakness

CWE details

CWE-78

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.