CVE-2026-19188: Haiwell IoT Cloud HMI Gateway OS Command Injection
A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Haiwell IoT Cloud HMI Gateway OS Command Injectionto a version that resolves this vulnerability.Fixed in Scada-v3.50.1.19 - Configuration
Disable the Net Check feature (accessible via the /setting endpoint) or restrict it so untrusted users cannot reach the endpoint.
Haiwell IoT Cloud HMI Gateway Net Check feature via /setting endpoint = disable or restrict access - Compensating control
Block/restrict access to the vulnerable Socket.io path that triggers the cmdPing command injection so only trusted clients can invoke it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19188?
CVE-2026-19188 is rated as critical with a severity score of 10.
How can I mitigate CVE-2026-19188?
To mitigate CVE-2026-19188, ensure that user input in the Net Check feature is properly sanitized and validated before processing.
What product is affected by CVE-2026-19188?
CVE-2026-19188 affects the Haiwell IoT Cloud HMI Gateway.
What type of vulnerability is CVE-2026-19188?
CVE-2026-19188 is classified as an OS Command Injection vulnerability.
When was CVE-2026-19188 published?
CVE-2026-19188 was published on August 14, 2026.