CVE-2026-79697: Command Injection in Advantech WISE-6610-NB
Description
CVE-2026-79697 is a critical command injection vulnerability affecting multiple versions of Advantech WISE-6610 series devices, specifically version 1.2.1_20251110. The flaw exists in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component, allowing remote attackers to execute arbitrary commands by manipulating the 'act' argument. The vendor has released a fixed version 1.2.4_20260821 to address this issue. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported.
CVSS v4.0
Score 9.4critical
Affected software
Advantech
WISE-6610-NB
Advantech
WISE-6610-EB
Advantech
WISE-6610-TB
Advantech
WISE-6610-JB
Advantech
WISE-6610-CB
Advantech
WISE-6610-EL-NB
Advantech
WISE-6610-EL-EB
Advantech
WISE-6610-EL-TB
Advantech
WISE-6610-EL-JB
Advantech
WISE-6610-EL-CB
Advantech
WISE-6610P-DEA
Advantech
WISE-6610P-DNA
Advantech
WISE-6610P-DTA
cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Advantech WISE-6610 series devices (including various models such as NB, EB, TB, JB, CB, EL-NB, EL-EB, EL-TB, EL-JB, EL-CB, P-DEA, P-DNA, and P-DTA) affects version 1.2.1_20251110. It arises from improper input validation in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component, enabling command injection via the 'act' argument. The vulnerability can be exploited remotely without user interaction and requires low attack complexity and privileges. The vendor responded promptly and released version 1.2.4_20260821 to mitigate the issue.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary commands on the affected device with high impact on confidentiality, integrity, availability, and system control. This can lead to complete compromise of the device and potentially the network it is connected to.
Mitigation Recommendations
Upgrade affected devices from version 1.2.1_20251110 to version 1.2.4_20260821 or later as provided by Advantech. This official fix addresses the command injection vulnerability. No other mitigation is required if the upgrade is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-25T12:13:37.537Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9e5f47acd9273b491b706d
Added to database: 09/07/2026, 06:52:55 UTC
Last enriched: 09/15/2026, 01:09:00 UTC
Last updated: 10/21/2026, 13:20:24 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.