A remote OS command injection vulnerability in Advantech WISE-6610 poses a significant risk of unauthorized system control due to the availability of public exploit material.

This vulnerability involves OS command injection within the /cgi-bin/luci/admin/openvpn_apply endpoint. By manipulating the delete_file argument, an authenticated attacker with high privileges can execute arbitrary operating system commands on the device.

Successful exploitation of this flaw allows an attacker to achieve full remote command execution on the affected gateway. This could lead to complete system compromise, the potential for lateral movement within the operational technology network, and unauthorized access to sensitive configuration data. Given the CVSS score of 7.2, this vulnerability represents a high-severity risk that requires immediate attention to prevent device takeover.

Immediate Action: Since the vendor has not provided a security update, administrators should immediately restrict network access to the management interface of the WISE-6610 to trusted management workstations only.

Proactive Monitoring: Monitor device logs for unusual activity or unauthorized requests targeting the /cgi-bin/luci/admin/openvpn_apply endpoint.

Compensating Controls: Implement strict firewall rules to block external access to the web management interface and utilize a Web Application Firewall to filter requests containing suspicious command injection patterns.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

The presence of a public proof-of-concept combined with the potential for full system compromise makes this a high-priority issue. Network administrators must isolate the affected hardware from the public internet immediately. Until the vendor releases a formal patch, limiting management access is the most effective strategy to prevent unauthorized exploitation of this device.