CVE-2026-79697

CVE-2026-79697 is a command injection flaw (CWE-74/CWE-77) in the basicstation_apply function of the Basic Station Certificate-Deletion Handler in Advantech WISE-6610 series industrial gateways running firmware 1.2.1_20251110. A remote attacker who can reach the gateway's management interface sends a manipulated 'act' argument to the certificate-deletion handler, causing arbitrary commands to be injected and executed on the device. The CVSS 4.0 score of 8.6 assumes only low privileges are required and rates confidentiality, integrity and availability impact as high, so successful exploitation effectively means full compromise of the gateway. Any organization running one of the thirteen affected WISE-6610/WISE-6610P models is affected, especially where the gateway's management interface is reachable from untrusted networks. The advisory states the exploit has been publicly disclosed (EPSS 3.4%, 88th percentile), though the flaw is not yet in CISA KEV and no standalone PoC is catalogued; the vendor responded quickly and shipped a fix in firmware 1.2.4_20260821.

What to do: Upgrade all thirteen affected WISE-6610/WISE-6610P models to firmware 1.2.4_20260821 or later. Until patching is complete, restrict access to the gateways' management interfaces to trusted management networks, review which accounts hold the low-privilege credentials the attack requires, and inventory any gateways exposed at remote or internet-facing sites. Monitor vendor advisories, as exploitation activity may follow the publicly disclosed exploit.