CVE-2026-79697: Command Injection in Advantech WISE-6610-NB
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AI Analysis
Technical Summary
This vulnerability affects multiple Advantech WISE-6610 models running firmware version 1.2.1_20251110. It is a command injection flaw in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component. Remote attackers can exploit this by manipulating the 'act' argument to execute arbitrary commands on the device. The vendor responded promptly and released version 1.2.4_20260821 as a fix.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary commands on affected devices, potentially leading to full system compromise. The CVSS 4.0 score is 9.4 (critical), reflecting high impact on confidentiality, integrity, and availability with no user interaction required and low attack complexity.
Mitigation Recommendations
Upgrade affected devices from version 1.2.1_20251110 to version 1.2.4_20260821 or later, as this version contains the official fix for the vulnerability. No other mitigation steps are indicated by the vendor.
CVE-2026-79697: Command Injection in Advantech WISE-6610-NB
Description
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS v4.0
Score 9.4critical
Affected software
cpe:2.3:a:advantech:wise-6610-nb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-eb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-tb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-jb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-cb:*:*:*:*:*:*:*:*cpe:2.3:a:advantech:wise-6610-el-nb:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects multiple Advantech WISE-6610 models running firmware version 1.2.1_20251110. It is a command injection flaw in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component. Remote attackers can exploit this by manipulating the 'act' argument to execute arbitrary commands on the device. The vendor responded promptly and released version 1.2.4_20260821 as a fix.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary commands on affected devices, potentially leading to full system compromise. The CVSS 4.0 score is 9.4 (critical), reflecting high impact on confidentiality, integrity, and availability with no user interaction required and low attack complexity.
Mitigation Recommendations
Upgrade affected devices from version 1.2.1_20251110 to version 1.2.4_20260821 or later, as this version contains the official fix for the vulnerability. No other mitigation steps are indicated by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-25T12:13:37.537Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a9e5f47acd9273b491b706d
Added to database: 09/07/2026, 06:52:55 UTC
Last enriched: 09/07/2026, 08:37:17 UTC
Last updated: 09/07/2026, 11:04:07 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.