A critical OS command injection vulnerability in the Haiwell IoT Cloud HMI Gateway allows unauthenticated attackers to gain full root-level control over the device.

This is an OS command injection vulnerability (CWE-78) located in the Net Check feature accessible via the /setting endpoint. By sending a malicious cmdPing Socket.io event, an unauthenticated attacker can execute arbitrary system commands with root privileges.

Successful exploitation provides attackers with complete control over the HMI Gateway, potentially allowing for the disruption of industrial processes or unauthorized access to internal network segments. With a CVSS score of 10.0, this represents the highest level of risk, requiring urgent attention to prevent total system and process compromise.

Immediate Action: Update the device firmware to version 3.50.1.19, which contains the necessary security fixes provided by the vendor.

Proactive Monitoring: Review system logs for unusual network traffic or unauthorized command execution attempts originating from the /setting endpoint.

Compensating Controls: Isolate the HMI Gateway within a restricted network segment and restrict access to the /setting endpoint to trusted IP addresses only.

Public Exploit Available: Unknown.

The criticality of this vulnerability cannot be overstated. Administrators must apply the vendor-provided patch to version 3.50.1.19 immediately and ensure that all affected gateways are no longer exposed to untrusted networks.