LiveActive security incident?Get immediate response
CVE Record

CVE-2026-2670: Advantech WISE-6610-NB Background Management openvpn_apply os command injection

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."

HighCVSS 8.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A privileged remote user could abuse the affected WISE-6610 management function to make the device execute operating-system commands. Successful exploitation could compromise device confidentiality, integrity, and availability. The supplied record rates it 8.6 High and identifies firmware 1.2.4_20260821 as the corrected release.

Executive priority

Treat as a prompt remediation priority, especially for remotely reachable gateways or environments with weak privileged-access controls. Upgrade to the vendor-identified fixed firmware and verify management-plane isolation. Escalate urgency if suspicious administrative activity or credential compromise is detected.

Technical view

The Background Management endpoint /cgi-bin/luci/admin/openvpn_apply improperly incorporates the delete_file argument into a shell command, causing CWE-77/CWE-78 command injection. Network access, low complexity, no user interaction, and high privileges are indicated. The corrected design uses allowlisted paths, numeric tunnel IDs, request rejection, and fs.unlink instead of a constructed shell command.

Likely exposure

Exposure applies to the thirteen listed WISE-6610 and WISE-6610P variants running 1.2.1_20251110. Risk is greatest where their management interface is reachable by untrusted networks or privileged credentials are compromised. Although the affected inventory also lists 1.2.4_20260821, the description explicitly identifies that version as the fix.

Exploitation context

A public exploit reference exists, so attempted exploitation is plausible. However, the supplied bundle marks KEV false and provides no evidence of active exploitation. The CVSS vector indicates that an attacker requires high privileges; this is not described as an unauthenticated compromise.

Researcher notes

The core flaw is shell-command construction from attacker-influenced delete_file data. The vendor’s remediation removes that data flow through fixed path mapping, numeric ID validation, and native file deletion. Public exploit availability is reported, but the bundle does not establish successful attacks in the wild. Avoid treating the affected-array inclusion of 1.2.4 as proof it remains vulnerable.

Mitigation direction

  • Upgrade affected devices to firmware 1.2.4_20260821 using Advantech guidance.
  • Until upgraded, restrict management-interface access to trusted administrative networks and hosts.
  • Protect privileged accounts with strong authentication controls and review unnecessary administrator access.
  • Back up configurations and follow vendor procedures before applying firmware updates.

Validation and detection

  • Inventory all listed WISE-6610 and WISE-6610P models and record their exact firmware versions.
  • Confirm each upgraded device reports firmware 1.2.4_20260821 or a later vendor-confirmed fixed release.
  • Verify management interfaces are not reachable from untrusted networks.
  • Review available management and system logs for unexpected access to openvpn_apply or suspicious administrative activity.
  • Confirm normal VPN configuration and deletion functions still operate after upgrading.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-77: Command execution behavior lookup

Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-78: Command execution behavior lookup

Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-2670 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.6 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

4CVSS vectors
7Timeline events
1ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: total

CVSS vector scores

4 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.6CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——VulDB
8.3CVSS 2.0HighAV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:OF/RC:C6.410VulDB
7.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C1.25.9VulDB
7.2CVSS 3.0HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C1.25.9VulDB

Vulnerability scoring details

Base CVSS 4.0 score

8.6High
CVSS 4.0 vector shape for CVE-2026-2670Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineVulDB

    Advisory disclosed

  2. Source timelineVulDB

    VulDB entry created

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. Source timelineVulDB

    Countermeasure disclosed

  6. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

  7. Source timelineVulDB

    VulDB entry last update

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
AdvantechWISE-6610-NB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-TB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-JB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-CB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-NB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-EB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-TB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-JB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-CB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610P-DEA1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610P-DNA1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610P-DTA1.2.1_20251110, 1.2.4_20260821Listed
Weakness

CWE details

CWE-77CWE-78

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.