CVE-2026-79698

CVE-2026-79698 is a remote command injection flaw in the nodered_lib_apply function of the Node-RED Library component in Advantech WISE-6610-series industrial routers running firmware 1.2.1_20251110. An attacker with network access to the device and at least low-level privileges can manipulate the "act" argument to inject and execute operating-system commands on the router. The vulnerability carries high impact ratings for confidentiality, integrity, and availability, so successful exploitation effectively gives an attacker full control of the device, which can serve as a foothold in industrial networks. All WISE-6610, WISE-6610-EL, and WISE-6610P variants on affected firmware are exposed, with remotely attackable deployments being those whose web/Node-RED interface reaches untrusted networks. A public exploit is available and exploitation is considered plausible (EPSS 1.7%, 76th percentile), but the flaw is not yet in CISA's KEV catalog and there are no confirmed in-the-wild incident reports.

What to do: Upgrade affected WISE-6610, WISE-6610-EL, and WISE-6610P routers to firmware 1.2.4_20260821 as soon as possible, since the vendor released this fixed version promptly after being notified. Operators running older builds (including 1.2.1_20251110) who cannot upgrade immediately should restrict access to the device's web/Node-RED management interface to trusted networks and review devices for signs of unexpected command execution.