CISA Flags CVSS 10 Bug in Haiwell HMI Gateway
The OS command injection requires no authentication and hands attackers root on gear deployed across energy, manufacturing, and water sectors.
TL;DR
CISA published an advisory Thursday for CVE-2026-19188, a CVSS 10 OS command injection vulnerability in Haiwell IoT Cloud HMI Gateway version 3.40.1.12. The flaw sits in the Net Check feature's cmdPing Socket.io event, which passes unsanitized user input directly to the OS and doesn't require authentication. The gateway is deployed worldwide across energy, critical manufacturing, and water and wastewater sectors. Haiwell has released patch Scada-v3.50.1.19. No known public exploitation has been reported.
The vulnerability lives in the /setting endpoint's Net Check feature. The cmdPing Socket.io event takes user-supplied input and passes it to the underlying operating system without sanitization, classic CWE-78. The result is unauthenticated remote code execution with root privileges. It's about as bad as a CVSS vector string gets: network-accessible, low attack complexity, no privileges required, no user interaction, total compromise of confidentiality, integrity, and availability on both the compromised device and downstream systems.
Haiwell is a Chinese industrial automation vendor whose HMI gateways bridge OT networks with cloud services. The affected sectors, energy, critical manufacturing, water and wastewater, are precisely the ones where unauthenticated root on network-connected OT gear is most dangerous. That said, CISA reports no known public exploitation of this vulnerability, and Haiwell's patch (Scada-v3.50.1.19) is available for download.
For OT security teams, CISA's standard guidance applies: keep the gateway off the internet, route any remote access through a VPN. But with a CVSS 10 and a patch already available, the real Monday-morning move is simpler than usual. Update to Scada-v3.50.1.19, and verify the device isn't reachable from the internet in the meantime.
Published ·Updated ·Deep Fathom