This vulnerability in Advantech WISE-6610-NB and related models allows remote command injection via the 'act' argument in the Node-RED Library's nodered_lib_apply function. The issue affects version 1.2.1_20251110 and can be exploited remotely without user interaction. The vendor responded promptly and released version 1.2.4_20260821 to fix the vulnerability. The CVSS 4.0 base score is 9.4, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows remote attackers to execute arbitrary commands on affected devices, potentially leading to full system compromise. Given the critical CVSS score and the nature of command injection, this could result in unauthorized control over the device and disruption of its intended operation.

Upgrade the affected Advantech WISE-6610 devices from version 1.2.1_20251110 to version 1.2.4_20260821 or later, as the vendor has released this fixed version to resolve the vulnerability. Applying this official update is the recommended and effective mitigation.