CVE-2026-79698: Advantech WISE-6610 command injection in Node-RED Library

CVE-2026-79698 · Severity: critical · CVSS 9.9 · Published 2026-09-07

Advantech WISE-6610 is an industrial IoT gateway widely used in manufacturing and critical infrastructure to collect and process sensor data. A remote command injection vulnerability in its Node-RED Library component allows attackers to execute arbitrary system commands without authentication, potentially gaining full control of the device and compromising connected networks and systems.

Technologies: Advantech WISE-6610-CB, Advantech WISE-6610-EB, Advantech WISE-6610-EL-CB, Advantech WISE-6610-EL-EB, Advantech WISE-6610-EL-JB, Advantech WISE-6610-EL-NB, Advantech WISE-6610-EL-TB, Advantech WISE-6610-JB, Advantech WISE-6610-NB, Advantech WISE-6610-TB, Advantech WISE-6610P-DEA, Advantech WISE-6610P-DNA, Advantech WISE-6610P-DTA. Vendors: Advantech.

Quick answers

Is CVE-2026-79698 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79698 being exploited in the wild.
How severe is CVE-2026-79698?
Critical severity, with a CVSS score of 9.9, published 7 September 2026.
Which products and versions are affected?
Advantech WISE-6610-CB 1.2.1_20251110 and earlier; Advantech WISE-6610-EB 1.2.1_20251110 and earlier; Advantech WISE-6610-EL-CB 1.2.1_20251110 and earlier; Advantech WISE-6610-EL-EB 1.2.1_20251110 and earlier; and 9 more.
Is there a fix for CVE-2026-79698?
A patch was published on 2026-08-21: Fixed version 1.2.4_20260821 released by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79698 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-79698?
Check whether you run Advantech WISE-6610-CB, Advantech WISE-6610-EB, Advantech WISE-6610-EL-CB or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the nodered_lib_apply function of the Node-RED Library component in affected Advantech WISE-6610 devices. The vulnerability is caused by insufficient input validation of the "act" argument, which allows an attacker to inject arbitrary shell commands. The attack is remotely exploitable without requiring authentication. An attacker can achieve remote code execution (RCE) with the privileges of the device's application process. The vulnerability affects versions prior to 1.2.4_20260821; upgrading to this version or later resolves the issue.

Affected products

  • Advantech WISE-6610-NB 1.2.1_20251110 and earlier
  • Advantech WISE-6610-EB 1.2.1_20251110 and earlier
  • Advantech WISE-6610-TB 1.2.1_20251110 and earlier
  • Advantech WISE-6610-JB 1.2.1_20251110 and earlier
  • Advantech WISE-6610-CB 1.2.1_20251110 and earlier
  • Advantech WISE-6610-EL-NB 1.2.1_20251110 and earlier
  • Advantech WISE-6610-EL-EB 1.2.1_20251110 and earlier
  • Advantech WISE-6610-EL-TB 1.2.1_20251110 and earlier
  • Advantech WISE-6610-EL-JB 1.2.1_20251110 and earlier
  • Advantech WISE-6610-EL-CB 1.2.1_20251110 and earlier
  • Advantech WISE-6610P-DEA 1.2.1_20251110 and earlier
  • Advantech WISE-6610P-DNA 1.2.1_20251110 and earlier
  • Advantech WISE-6610P-DTA 1.2.1_20251110 and earlier

Timeline

  • 2026-09-07: disclosed: Vulnerability publicly disclosed via NVD
  • 2026-08-21: patched: Fixed version 1.2.4_20260821 released by vendor

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.