Haiwell IoT gateway CVSS 10.0 flaw grants root RCE

CISA's August 13 advisory on CVE-2026-19188 is the kind that gets CISOs canceling their afternoon meetings. The score is a perfect 10.0. The attack requires no authentication, no privileges, and no user interaction. An attacker who finds an internet-facing Haiwell IoT Cloud HMI Gateway running version 3.40.1.12 can execute arbitrary OS commands as root. That's the whole attack chain.

The vulnerability sits in the Net Check feature, accessed through the /setting endpoint. The cmdPing Socket.io event takes user-supplied input and passes it to the underlying operating system without sanitization, a textbook OS command injection (CWE-78). Researcher Fiqram Akmal reported it to CISA through coordinated vulnerability disclosure. The CVSS 3.1 vector string, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, confirms what the description already implies: there is no mitigating factor. The scope is changed (S:C), meaning the vulnerable component and the impacted component are different, and the impact scores are all High across confidentiality, integrity, and availability. Under CVSS 4.0, the score is also 10.0.

Haiwell has released a patch in version Scada-v3.50.1.19, available from the company's website. The affected gateways are deployed worldwide across energy and critical manufacturing, as well as water and wastewater systems. For security teams in those sectors, the remediation path is straightforward: patch. But the operational question is harder. Many OT environments can't take gateways offline without scheduling downtime weeks in advance. A CVSS 10.0 with public disclosure creates a race between the patching cycle and any threat actor who reverse-engineers the advisory. CISA's standard language notes "no known public exploitation specifically targeting this vulnerability has been reported to CISA at this time," which is the expected caveat on day zero of disclosure and should not be read as reassurance.

The open question is whether a CVSS 10.0 in a device explicitly listed for energy and water sectors triggers any accelerated patch mandates under NERC CIP or water-sector cybersecurity regulations. The advisory doesn't address it, and neither framework has a clean mechanism for converting a CISA ICS advisory severity into an emergency patch deadline. In practice, that means the decision sits with individual asset owners, some of whom will patch within 72 hours and some of whom won't know the gateway is there until someone notices unusual traffic.