A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVE-2026-79697 is a critical command injection vulnerability affecting multiple versions of Advantech WISE-6610 series devices, specifically version 1.2.1_20251110. The flaw exists in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component, allowing remote attackers to execute arbitrary commands by manipulating the 'act' argument. The vendor has released a fixed version 1.2.4_20260821 to address this issue. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported.
A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.
A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.
Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.
Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.
Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to
execute arbitrary commands via a specific interface,
potentially enabling the attacker to access, modify, or delete sensitive
information within the database.
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."
Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators of affected product versions are advised to update to the latest versions immediately.
CVE-2025-67653 is a medium-severity directory traversal vulnerability in Advantech WebAccess/SCADA version 9.2.1. It allows an attacker with low privileges and no user interaction to determine the existence of arbitrary files on the system. The vulnerability does not impact integrity or availability but can leak sensitive file presence information, potentially aiding further attacks. No known exploits are currently in the wild. European organizations using this SCADA platform, especially in critical infrastructure sectors, may be at risk. Mitigation requires patching or implementing strict input validation and access controls. Countries with significant industrial automation and critical infrastructure deployments of Advantech products are most likely affected. The vulnerability has a CVSS score of 4.
CVE-2025-46268 is a medium-severity SQL injection vulnerability in Advantech WebAccess/SCADA version 9.2.1. It allows an attacker with low privileges to execute arbitrary SQL commands remotely without user interaction. This flaw can impact confidentiality, integrity, and availability of the affected SCADA system. Although no known exploits are reported in the wild yet, the vulnerability poses a significant risk to industrial control environments. European organizations using this SCADA platform should prioritize patching or mitigating this issue. The vulnerability is particularly relevant to countries with critical infrastructure relying on Advantech SCADA solutions. Mitigation requires applying vendor patches once available, restricting access to the SCADA interface, and implementing strict input validation and network segmentation. Given the critical role of SCADA systems in industrial and utility sectors, exploitation could lead to operational disruptions and data compromise.
CVE-2025-14848 is an absolute directory traversal vulnerability in Advantech WebAccess/SCADA version 9.2.1. This flaw allows an attacker with low privileges to determine the existence of arbitrary files on the system without requiring user interaction. The vulnerability impacts confidentiality but does not affect integrity or availability. Exploitation is possible remotely over the network with low attack complexity. No known exploits are currently reported in the wild. The vulnerability is rated medium severity with a CVSS score of 4.3. European organizations using this SCADA platform should prioritize patching or mitigating this issue to prevent potential reconnaissance by attackers.
CVE-2025-14849 is a high-severity vulnerability in Advantech WebAccess/SCADA version 9.2.1 that allows unrestricted file upload, enabling remote attackers with low privileges to execute arbitrary code without user interaction. This vulnerability arises from improper validation of uploaded files (CWE-434), potentially compromising confidentiality, integrity, and availability of affected systems. Although no known exploits are currently reported in the wild, the vulnerability's characteristics make it a significant risk for industrial control systems relying on this SCADA platform. European organizations operating critical infrastructure using Advantech WebAccess/SCADA are at risk, especially in countries with high adoption of industrial automation and manufacturing sectors. Mitigation requires immediate application of vendor patches once available, strict network segmentation, and enhanced monitoring of file upload functionalities. Countries such as Germany, France, Italy, and the UK are likely most affected due to their industrial base and use of such SCADA systems. Given the ease of exploitation over the network with low privileges and no user interaction, the threat severity is high.
CVE-2025-14850 is a high-severity directory traversal vulnerability in Advantech WebAccess/SCADA version 9.2.1. It allows an attacker with limited privileges to delete arbitrary files on the affected system without user interaction. The vulnerability stems from improper input validation, enabling traversal outside intended directories. Exploitation can lead to significant integrity and availability impacts by removing critical files. Although no known exploits are currently reported in the wild, the vulnerability's network accessibility and low attack complexity make it a serious risk. European organizations using Advantech WebAccess/SCADA in industrial control environments should prioritize patching or applying mitigations. Countries with substantial industrial automation sectors and critical infrastructure relying on this product are at higher risk. Mitigation involves restricting access, applying vendor patches when available, and monitoring file system integrity closely.
An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in privilege escalation, arbitrary code execution, and information disclosure. This issue affects Advantech SUSI: 5.0.24335 and prior.
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint. When an authenticated user creates or updates a rule for an agent, the rule fields min, max, and unit are stored and later rendered in rule listings or detail views without proper HTML sanitation. An attacker can inject malicious script into one or more of these fields, which is then executed in the browser context of users who view or interact with the affected rule, potentially enabling session compromise and unauthorized actions as the victim.
