CVE-2026-19188

CRITICAL 10.0

Haiwell IoT Cloud HMI Gateway OS Command Injection

CVSS Score

10.0

EPSS Score

0.0%

EPSS Percentile

0th

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.

CWE	CWE-78
Vendor	haiwell
Product	haiwell iot cloud hmi gateway
Published	Aug 14, 2026
Last Updated	Aug 14, 2026

Stay Ahead of the Next One

Get instant alerts for haiwell haiwell iot cloud hmi gateway

Be the first to know when new critical vulnerabilities affecting haiwell haiwell iot cloud hmi gateway are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Haiwell / Haiwell IoT Cloud HMI Gateway

3.40.1.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

en.haiwell.com: https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361 cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-02 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-225-02.json

Credits

Fiqram Akmal reported this vulnerability to CISA.