CVE-2026-79698: Advantech WISE-6610 RCE Vulnerability

CVE-2026-79698 Overview

CVE-2026-79698 is a command injection vulnerability affecting multiple Advantech WISE-6610 series industrial routers running firmware version 1.2.1_20251110. The flaw resides in the nodered_lib_apply function of the Node-RED Library component. Attackers can manipulate the act argument to inject arbitrary operating system commands. The vulnerability is remotely exploitable and requires only low-privileged authentication. A public exploit exists, increasing the risk of active abuse against exposed devices. Advantech was contacted early and released fixed firmware version 1.2.4_20260821 to resolve the issue.

Critical Impact
Remote authenticated attackers can execute arbitrary commands on affected Advantech WISE-6610 routers, gaining full control of edge network infrastructure and potentially pivoting into operational technology (OT) environments.

Affected Products

Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB (firmware 1.2.1_20251110)
Advantech WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB (firmware 1.2.1_20251110)
Advantech WISE-6610P-DEA, WISE-6610P-DNA, WISE-6610P-DTA (firmware 1.2.1_20251110)

Discovery Timeline

2026-09-07 - CVE-2026-79698 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-79698

Vulnerability Analysis

The vulnerability is classified as an Improper Neutralization of Special Elements in Output Used by a Downstream Component [CWE-74], commonly known as command injection. The nodered_lib_apply function in the Node-RED Library component fails to sanitize the act parameter before passing it to a downstream shell or command interpreter. This allows an attacker with network access and low-level privileges to append arbitrary shell metacharacters and commands. Successful exploitation grants command execution in the context of the process handling the Node-RED library operation, typically with elevated privileges on the embedded Linux router.

Root Cause

The root cause is missing input validation and neutralization of shell metacharacters in the act argument passed to nodered_lib_apply. User-supplied data flows directly into a system command invocation without escaping, filtering, or the use of safe execution APIs.

Attack Vector

Exploitation occurs over the network against the router's management interface. The attacker must hold a low-privilege authenticated session to reach the vulnerable endpoint. Once authenticated, submitting a crafted act parameter containing shell metacharacters triggers command execution. A public proof-of-concept is referenced in the VulDB entry for CVE-2026-79698 and the Feishu Wiki technical write-up.

// No verified exploit code is reproduced here.
// Refer to the linked VulDB and Feishu Wiki references for technical details.

Detection Methods for CVE-2026-79698

Indicators of Compromise

Unexpected outbound connections originating from WISE-6610 routers to unknown hosts.
Unauthorized modifications to Node-RED flows, libraries, or startup scripts on the device.
Web server or management interface logs containing unusual shell metacharacters (;, |, &, backticks) in requests referencing the Node-RED library endpoint.

Detection Strategies

Inspect HTTP request logs on the router management interface for act parameter values containing shell metacharacters or command substitution patterns.
Monitor for anomalous child processes spawned by the Node-RED runtime, such as /bin/sh, wget, curl, or nc.
Correlate authentication events with subsequent configuration changes to identify low-privilege accounts triggering privileged operations.

Monitoring Recommendations

Forward router syslog and web management logs to a centralized SIEM for retention and rule-based alerting.
Baseline normal Node-RED activity on WISE-6610 devices and alert on deviations in outbound traffic volume or destinations.
Track firmware versions across the fleet and alert on any device still running vulnerable firmware 1.2.1_20251110.

How to Mitigate CVE-2026-79698

Immediate Actions Required

Upgrade all affected WISE-6610 devices to firmware 1.2.4_20260821 or later, available from the Advantech firmware support page.
Restrict network access to the router management interface using firewall rules and place devices behind a VPN where possible.
Rotate credentials for all user accounts on the device, particularly low-privilege accounts that could reach the vulnerable endpoint.

Patch Information

Advantech has released firmware version 1.2.4_20260821 that resolves CVE-2026-79698. The vendor was responsive during coordinated disclosure and issued the fix promptly. Additional advisory information is available on the Advantech Security Advisory portal.

Workarounds

Disable the Node-RED Library component if it is not required for operational use.
Segment WISE-6610 routers onto isolated management VLANs and block untrusted networks from reaching the administrative interface.
Enforce strict role-based access control so that only trusted operators hold accounts on the device.

bash

# Example: restrict management interface access with firewall rules
iptables -A INPUT -p tcp --dport 443 -s <trusted-mgmt-subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP