CVE-2026-79697: Advantech WISE-6610 RCE Vulnerability

CVE-2026-79697 Overview

CVE-2026-79697 is a command injection vulnerability affecting the Advantech WISE-6610 series of industrial LoRaWAN gateways running firmware 1.2.1_20251110. The flaw resides in the basicstation_apply function of the Basic Station Certificate-Deletion Handler. An authenticated remote attacker can manipulate the act argument to inject arbitrary operating system commands. The issue is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Public disclosure of exploit details has occurred, increasing the likelihood of opportunistic abuse against exposed gateways.

Critical Impact

A low-privileged remote attacker can execute arbitrary commands on affected WISE-6610 gateways, leading to full device compromise and potential pivot into connected operational technology (OT) networks.

Affected Products

• Advantech WISE-6610 series (WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB) firmware 1.2.1_20251110
• Advantech WISE-6610-EL series (WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB) firmware 1.2.1_20251110
• Advantech WISE-6610P series (WISE-6610P-DEA, WISE-6610P-DNA, WISE-6610P-DTA) firmware 1.2.1_20251110

Discovery Timeline

• 2026-09-07 - CVE-2026-79697 published to NVD
• 2026-09-08 - Last updated in NVD database
• Fixed firmware release - Advantech released firmware 1.2.4_20260821 addressing the vulnerability

Technical Details for CVE-2026-79697

Vulnerability Analysis

The WISE-6610 gateways expose a web-based administration interface used to manage Basic Station, the reference LoRaWAN packet-forwarder. The Certificate-Deletion Handler invokes the basicstation_apply function to process user-supplied parameters and orchestrate certificate management on the device. The handler passes the act argument into a downstream shell context without adequate sanitization or argument quoting. An authenticated attacker can append shell metacharacters to act and force the gateway to execute injected commands with the privileges of the web management process. Because these devices are frequently deployed at the edge of industrial and IoT networks, a successful compromise can enable lateral movement toward LoRaWAN sensors, PLCs, and upstream network services.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream component (CWE-74). The basicstation_apply function concatenates the act parameter into a shell command string rather than executing the underlying binary via a safe argument array. Any shell metacharacter, such as ;, |, $(), or backticks, is interpreted by the invoked shell.

Attack Vector

Exploitation requires network access to the gateway's management interface and a valid low-privileged account. The attacker issues a crafted HTTP request to the Basic Station Certificate-Deletion endpoint with a malicious act value. The gateway then executes the injected commands. No user interaction is required, and the attack can be automated at scale against internet-exposed devices.

No verified proof-of-concept code has been published in a structured format at the time of writing.
Refer to the VulDB entry for CVE-2026-79697 for additional technical context:
https://vuldb.com/cve/CVE-2026-79697

Detection Methods for CVE-2026-79697

Indicators of Compromise

• Unexpected child processes (for example, sh, busybox, wget, curl, nc) spawned by the WISE-6610 web management daemon shortly after HTTP requests to the Basic Station certificate endpoints.
• Outbound connections from the gateway to unfamiliar IP addresses or ports, particularly on non-LoRaWAN channels.
• New or modified files under Basic Station certificate directories, or new cron/init entries providing persistence.

Detection Strategies

• Inspect HTTP access logs for requests targeting the Basic Station certificate-deletion endpoint containing shell metacharacters (;, |, &, `, $() in the act parameter.
• Correlate management-interface authentication events with subsequent anomalous process activity on the device.
• Deploy signatures on inline network security controls to flag command-injection patterns targeting Advantech WISE-6610 management URLs.

Monitoring Recommendations

• Forward gateway syslog and web-server logs to a centralized SIEM and alert on command-injection tokens in query strings and POST bodies.
• Baseline expected outbound connections from WISE-6610 devices and alert on deviations, especially connections to public IP addresses.
• Monitor for firmware version drift and unauthorized configuration changes across the WISE-6610 fleet.

How to Mitigate CVE-2026-79697

Immediate Actions Required

• Upgrade affected WISE-6610, WISE-6610-EL, and WISE-6610P devices to firmware 1.2.4_20260821 or later as published on the Advantech Firmware Support page.
• Remove any exposure of the WISE-6610 management interface from the public internet and restrict access to trusted management VLANs.
• Rotate all administrative credentials on affected gateways and audit accounts for unauthorized additions.
• Review process, filesystem, and network telemetry for indicators of prior exploitation before returning devices to service.

Patch Information

Advantech has released firmware 1.2.4_20260821 that remediates the command injection in the basicstation_apply handler. Refer to the Advantech Security Advisory portal and the VulDB entry for CVE-2026-79697 for authoritative advisory details.

Workarounds

• Restrict the management interface to a dedicated administrative network using firewall ACLs or a jump host until firmware can be applied.
• Disable or limit low-privileged accounts that can reach Basic Station certificate management endpoints.
• Place gateways behind a reverse proxy or WAF that filters shell metacharacters in the act parameter for Basic Station endpoints.

# Example iptables rule restricting the WISE-6610 web management interface
# to a trusted management subnet (adjust interface and subnet as needed)
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80  -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80  -j DROP