LiveActive security incident?Get immediate response
CVE Record

CVE-2026-79697: Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection

A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CriticalCVSS 9.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A remotely reachable, low-privilege user could abuse certificate-deletion handling in affected Advantech WISE-6610 gateways to run unauthorized operating-system commands. This could enable device takeover, data exposure, configuration changes, or service disruption. Firmware 1.2.4_20260821 is identified as the fixed release.

Executive priority

Treat this as an urgent remediation item because successful exploitation could compromise gateway confidentiality, integrity, and availability. Patch externally reachable and operationally critical devices first. Public exploit information raises urgency, although the supplied evidence does not confirm active exploitation.

Technical view

The basicstation_apply function does not safely handle the act argument in the Basic Station Certificate-Deletion handler, causing CWE-74/CWE-77 command injection. CVSS 3.1 is 9.9: network-accessible, low complexity, low privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impact.

Likely exposure

Exposure applies to the listed WISE-6610, WISE-6610-EL, and WISE-6610P variants running firmware 1.2.1_20251110. Risk is greatest where their management or Basic Station interfaces are reachable from untrusted networks or accessible through compromised low-privilege accounts. The bundle identifies 1.2.4_20260821 as fixed, not affected.

Exploitation context

A public exploit disclosure is referenced, increasing practical risk. The attack is remote but requires low privileges. The source bundle does not establish observed attacks, and the CVE is not listed in KEV; therefore, active exploitation should not be claimed.

Researcher notes

Version interpretation matters: the affected inventory data lists both 1.2.1_20251110 and 1.2.4_20260821, but the narrative explicitly identifies 1.2.4_20260821 as mitigating the issue. Researchers should validate exposure through version and configuration review without exercising the injection path on production systems.

Mitigation direction

  • Upgrade affected devices to firmware 1.2.4_20260821 using Advantech's published firmware guidance.
  • Prioritize internet-reachable or broadly accessible management interfaces for immediate remediation.
  • Until upgraded, restrict management access to trusted administrative networks and authorized accounts.
  • Review Advantech's security advisory for model-specific installation requirements and subsequent guidance.

Validation and detection

  • Inventory all listed WISE-6610 variants and record their exact installed firmware versions.
  • Confirm affected devices no longer run firmware 1.2.1_20251110 after maintenance.
  • Verify the installed firmware reports version 1.2.4_20260821 or a later vendor-approved release.
  • Review device and authentication logs for unusual certificate-deletion activity or unexpected administrative actions.
  • Confirm management interfaces are not unnecessarily reachable from untrusted networks.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-74: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-77: Command execution behavior lookup

Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-79697 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

4CVSS vectors
7Timeline events
1ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: total

CVSS vector scores

4 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.9CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C3.16VulDB
9.9CVSS 3.0CriticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C3.16VulDB
9.4CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P——VulDB
9CVSS 2.0CriticalAV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C810VulDB

Vulnerability scoring details

Base CVSS 4.0 score

9.4Critical
CVSS 4.0 vector shape for CVE-2026-79697Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Source timelineVulDB

    Countermeasure disclosed

  3. Source timelineVulDB

    Advisory disclosed

  4. Source timelineVulDB

    VulDB entry created

  5. CVE publishedCVE Program

    The CVE record was published.

  6. Source timelineVulDB

    VulDB entry last update

  7. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
AdvantechWISE-6610-NB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-TB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-JB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-CB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-NB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-EB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-TB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-JB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610-EL-CB1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610P-DEA1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610P-DNA1.2.1_20251110, 1.2.4_20260821Listed
AdvantechWISE-6610P-DTA1.2.1_20251110, 1.2.4_20260821Listed
Weakness

CWE details

CWE-74CWE-77

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-74 · source CWE mapping

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs
CWE-77 · source CWE mapping

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs