# CVE-2026-2670: Advantech WISE-6610 OS command injection in OpenVPN management

Source: https://junglewise.ai/threats/cve-2026-2670-advantech-wise-6610-os-command-injection-in-openvpn-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-2670 · Severity: high · CVSS 7.2 · Published 2026-02-18

Advantech WISE-6610 is an industrial IoT gateway used to manage networks and remote access. A vulnerability in its web-based management interface allows an attacker to inject and execute arbitrary system commands with root privileges by manipulating file deletion requests, potentially giving complete control over the device.

Technologies: [Advantech WISE-6610-CB](https://junglewise.ai/threats/technologies/wise-6610-cb), [Advantech WISE-6610-EB](https://junglewise.ai/threats/technologies/wise-6610-eb), [Advantech WISE-6610-EL-CB](https://junglewise.ai/threats/technologies/wise-6610-el-cb), [Advantech WISE-6610-EL-EB](https://junglewise.ai/threats/technologies/wise-6610-el-eb), [Advantech WISE-6610-EL-JB](https://junglewise.ai/threats/technologies/wise-6610-el-jb), [Advantech WISE-6610-EL-NB](https://junglewise.ai/threats/technologies/wise-6610-el-nb), [Advantech WISE-6610-EL-TB](https://junglewise.ai/threats/technologies/wise-6610-el-tb), [Advantech WISE-6610-JB](https://junglewise.ai/threats/technologies/wise-6610-jb), [Advantech WISE-6610-NB](https://junglewise.ai/threats/technologies/wise-6610-nb), [Advantech WISE-6610-TB](https://junglewise.ai/threats/technologies/wise-6610-tb), [Advantech WISE-6610P-DEA](https://junglewise.ai/threats/technologies/wise-6610p-dea), [Advantech WISE-6610P-DNA](https://junglewise.ai/threats/technologies/wise-6610p-dna), [Advantech WISE-6610P-DTA](https://junglewise.ai/threats/technologies/wise-6610p-dta). Vendors: [Advantech](https://junglewise.ai/threats/vendors/advantech).

## Quick answers

**Is CVE-2026-2670 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2670 being exploited in the wild.

**How severe is CVE-2026-2670?** High severity, with a CVSS score of 7.2, published 18 February 2026.

**Which products and versions are affected?** Advantech WISE-6610-CB 1.2.1_20251110; Advantech WISE-6610-EB 1.2.1_20251110; Advantech WISE-6610-EL-CB 1.2.1_20251110; Advantech WISE-6610-EL-EB 1.2.1_20251110; and 9 more.

**Is there a fix for CVE-2026-2670?** A patch was published on 2026-02-18: Patch available in firmware version 1.2.4_20260821 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2670 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-2670?** Check whether you run Advantech WISE-6610-CB, Advantech WISE-6610-EB, Advantech WISE-6610-EL-CB or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection flaw in the /cgi-bin/luci/admin/openvpn_apply endpoint of the Background Management component. The vulnerable code constructs a shell command from user-supplied input (the delete_file parameter) without proper sanitization, then executes it via os.execute(). An authenticated attacker can send a crafted POST request with malicious shell metacharacters in the delete_file argument to achieve arbitrary command execution as root. The attack is network-accessible and requires valid authentication. The vendor patched the issue in version 1.2.4_20260821 by redesigning the delete operation to use an allowlist of file paths, require numeric tunnel IDs, and use the native filesystem API instead of shell command construction.

## Affected products

- Advantech WISE-6610-NB 1.2.1_20251110
- Advantech WISE-6610-EB 1.2.1_20251110
- Advantech WISE-6610-TB 1.2.1_20251110
- Advantech WISE-6610-JB 1.2.1_20251110
- Advantech WISE-6610-CB 1.2.1_20251110
- Advantech WISE-6610-EL-NB 1.2.1_20251110
- Advantech WISE-6610-EL-EB 1.2.1_20251110
- Advantech WISE-6610-EL-TB 1.2.1_20251110
- Advantech WISE-6610-EL-JB 1.2.1_20251110
- Advantech WISE-6610-EL-CB 1.2.1_20251110
- Advantech WISE-6610P-DEA 1.2.1_20251110
- Advantech WISE-6610P-DNA 1.2.1_20251110
- Advantech WISE-6610P-DTA 1.2.1_20251110

## Timeline

- 2026-02-18: disclosed
- 2026-02-18: patched: Patch available in firmware version 1.2.4_20260821

## References

- [https://github.com/master-abc/cve/issues/37](https://github.com/master-abc/cve/issues/37)
- [https://vuldb.com/cve/CVE-2026-2670](https://vuldb.com/cve/CVE-2026-2670)

## Related threats

- [Advantech WISE-6610 command injection in Node-RED Library](https://junglewise.ai/threats/cve-2026-79698-advantech-wise-6610-command-injection-in-node-red-library)
- [Advantech WISE-6610 command injection in certificate deletion](https://junglewise.ai/threats/cve-2026-79697-advantech-wise-6610-command-injection-in-certificate-deletion)