A critical command injection vulnerability in Advantech WISE-6610 series devices allows remote attackers with low-level privileges to achieve full system compromise.

The vulnerability exists within the nodered_lib_apply function of the Node-RED Library component, where improper neutralization of special elements in the act argument permits command injection. The attack vector is network-based and requires low-level privileges to trigger the execution of arbitrary commands on the underlying operating system.

The ability to execute arbitrary commands remotely on industrial gateway hardware presents an extreme risk to operational technology environments. Successful exploitation grants an attacker full control over the device, potentially leading to unauthorized network access, data exfiltration, or the disruption of industrial control processes. With a CVSS score of 9.9, this vulnerability is considered critical and requires immediate attention to prevent severe operational downtime or safety-related incidents.

Immediate Action: Upgrade all affected Advantech WISE-6610 series devices to firmware version 1.2.4_20260821 as provided by the vendor.

Proactive Monitoring: Review system and audit logs for unusual process execution or unauthorized modifications to the Node-RED configuration files.

Compensating Controls: Implement strict network segmentation and firewall rules to restrict access to the device management interface to authorized personnel only, effectively mitigating the remote attack vector.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research write-up.

Given the critical nature of this vulnerability and the availability of a public proof-of-concept, organizations must prioritize patching all affected Advantech WISE-6610 gateways immediately. Administrators should verify their current firmware version and apply the 1.2.4_20260821 update across the entire fleet to eliminate the command injection vector. Failure to remediate this issue exposes critical infrastructure to unauthorized remote command execution.