Description
A vulnerability was identified in Advantech WISE-6610 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-02-18
Score: 8.6 High
EPSS: 16.3% Moderate
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw allows a remote attacker to supply an arbitrary value for the delete_file parameter in the /cgi-bin/luci/admin/openvpn_apply CGI script, resulting in execution of arbitrary OS commands by the web server process (CWE-77, CWE-78). Because the commands run with the server’s privileges, an attacker could compromise the confidentiality, integrity, and availability of the entire device.

Affected Systems

Advantech WISE-6610 devices running firmware 1.2.1_20251110 are affected. No other firmware versions are listed. The vulnerability lies in the publicly accessible Background Management component and is constrained to the openvpn_apply CGI script; other firmware revisions are not indicated in the data.

Risk and Exploitability

The CVSS base score of 8.6 places the issue in the High severity range. An EPSS score of 16% indicates a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the exposed endpoint remotely without local privileges. Because the injected commands run under the web server’s user rights, the risk of device compromise is appreciable.

Generated by OpenCVE AI on August 4, 2026 at 08:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Block or restrict external access to /cgi-bin/luci/admin/openvpn_apply via firewall or ACLs to limit exposure to trusted networks.
  • Enforce strict input validation for the delete_file parameter, ensuring that only permitted values or file names are accepted, thereby preventing command injection.
  • Enable logging of delete_file requests and monitor for anomalous values or patterns indicative of exploitation attempts.
  • Check Advantech website for security updates or patches.

Generated by OpenCVE AI on August 4, 2026 at 08:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 20 Feb 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 19 Feb 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Advantech
Advantech wise-6610
Vendors & Products Advantech
Advantech wise-6610

Wed, 18 Feb 2026 21:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Advantech WISE-6610 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Advantech WISE-6610 Background Management openvpn_apply os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Advantech Wise-6610
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T10:25:15.372Z

Reserved: 2026-02-18T09:16:43.848Z

Link: CVE-2026-2670

cve-icon Vulnrichment

Updated: 2026-02-20T19:32:43.252Z

cve-icon NVD

Status : Deferred

Published: 2026-02-18T22:16:27.360

Modified: 2026-06-17T10:31:30.610

Link: CVE-2026-2670

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T09:00:06Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')