Read the docs
TI-2026-02282 Aliases CVE-2026-2670GHSA-36ph-wmrq-6hrj

Advantech WISE-6610-NB Background Management openvpn_apply os command injection

Priority HIGH 72CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.13915 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed WISE-6610-NB (Advantech): 1.2.4_20260821WISE-6610-EB (Advantech): 1.2.4_20260821+11 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdvantechWISE-6610-NB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-TB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-JB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-CB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-NB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-EB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-TB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-JB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610-EL-CB1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610P-DEA1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610P-DNA1.2.1_202511101.2.4_20260821Patch availableCNA
AdvantechWISE-6610P-DTA1.2.1_202511101.2.4_20260821Patch availableCNA
  • WISE-6610-NB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-TB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-JB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-CB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-NB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-EB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-TB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-JB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610-EL-CB VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610P-DEA VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610P-DNA VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA
  • WISE-6610P-DTA VendorAdvantech Affected 1.2.1_20251110 Fixed in 1.2.4_20260821 Patch available CNA

CPE names CNA · 13

CPEVersionsRoleVendor
cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:*——Advantech
  • cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-eb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-tb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-jb:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610-el-cb:*:*:*:*:*:*:*:* Versions — — ·Advantech
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:*——Advantech
cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:*——Advantech
  • cpe:2.3:a:advantech:wise-6610p-dea:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610p-dna:*:*:*:*:*:*:*:* Versions — — ·Advantech
  • cpe:2.3:a:advantech:wise-6610p-dta:*:*:*:*:*:*:*:* Versions — — ·Advantech

Remediation

  • Fix · CNA WISE-6610-NB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-TB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-JB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-CB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-NB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-EB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-TB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-JB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610-EL-CB (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610P-DEA (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610P-DNA (Advantech) Fixed in 1.2.4_20260821
  • Fix · CNA WISE-6610P-DTA (Advantech) Fixed in 1.2.4_20260821

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-2670
  2. 2026-10-03 Alias added: GHSA-36ph-wmrq-6hrj
  3. 2026-10-16 EPSS moved to the 90th–95th percentile
  4. 2026-10-25 EPSS moved to the 95th–99th percentile

References

Exploit 1

Patch 1

Other 2

  • TI-2022-01984 Command injection in Advantech iView CVSS 3.1CRITICAL 9.8
  • TI-2025-24399 Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass CVSS 4.0CRITICAL 10.0
  • TI-2023-05193 Advantech R-SeeNet Unauthenticated Read/Write CVSS 3.1CRITICAL 9.8
  • TI-2016-00768 Unrestricted file upload vulnerability in the uploadImageCommon function in the… CVSS 3.0CRITICAL 9.8
  • TI-2021-04850 OS command injection in Advantech CVSS 3.1CRITICAL 9.8
  • TI-2026-55194 Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection CVSS 4.0CRITICAL 9.4
See all 433 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences