Cyber & AI intelligence
Wasteland.
Briefs indexed2462
Issues27
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-79698 2026-09-07

Advantech WISE-6610 Node-RED Command Injection (CVE-2026-79698)

"A reported command injection in the Node-RED Library component of Advantech WISE-6610 LoRaWAN gateways would let a remote, low-privileged attacker execute arbitrary commands; VulDB lists firmware 1.2.4_20260821 as the…"

A reported command injection in the Node-RED Library component of Advantech WISE-6610 LoRaWAN gateways would let a remote, low-privileged attacker execute arbitrary commands; VulDB lists firmware 1.2.4_20260821 as the fixed version.

What Is It

CVE-2026-79698 is described by VulDB as a command injection flaw in the nodered_lib_apply function of the Node-RED Library component shipped in Advantech WISE-6610 series devices running version 1.2.1_20251110. According to that entry, manipulation of the act argument leads to command injection and the attack can be launched remotely. VulDB's CVSS 4.0 assessment scores it 8.6 (HIGH) via CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P; its CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H scores 9.9 (CRITICAL). Both scores are VulDB's own, not NVD-adjudicated.

Everything above traces to a single chain of sourcing: VulDB submission 879219, the resulting VulDB vulnerability record 399513, and a researcher wiki writeup hosted on Feishu. There is no vendor advisory text, independent reproduction, or third-party analysis corroborating the affected function, the injectable parameter, or the impact rating. Treat the technical specifics as an unconfirmed single-source report.

The identifier itself is also unresolved. The sequence number 79698 sits well above the range CVE IDs were being assigned in as of early September 2026, and no NVD record for CVE-2026-79698 could be confirmed; so the CVE ID should be treated as unverified. Track this issue by its VulDB vulnerability ID 399513, which is the stable reference for the underlying finding, and confirm the CVE mapping against an Advantech advisory before using the identifier in tickets, detections, or reporting.

Why It Matters

VulDB states that an exploit is publicly available and rates CVSS 4.0 exploit maturity as Proof-of-Concept; the proof-of-concept itself has not been independently verified. Under the vectors as submitted, attack complexity is low, no user interaction is required, and only low privileges are needed. Both vectors rate confidentiality, integrity, and availability impact as HIGH, and both the 4.0 subsequent-system metrics and the 3.1 scope-changed flag indicate impact beyond the vulnerable component itself. These are network-attached gateway devices, so if the report holds, command execution would reach the device operating context directly over the network.

This issue is not listed in CISA's Known Exploited Vulnerabilities (KEV) Catalog, so there is no KEV-confirmed active exploitation and no BOD 22-01 federal remediation deadline attached to it. Given the claimed public proof-of-concept, absence from KEV should not by itself be read as an argument for deferring the patch.

What's Vulnerable

Per the VulDB entry, Advantech version 1.2.1_20251110 of the following products, in the Node-RED Library module. This product list has not been confirmed against a vendor advisory:

Version 1.2.4_20260821 is listed as unaffected across all thirteen products.

Patch Status

Reported fixed. VulDB indicates that upgrading to version 1.2.4_20260821 resolves the issue and that upgrading the affected component is the advised remediation. The same entry reports that the vendor was contacted early, responded professionally, and quickly released a fixed version; that account comes from the submitter rather than from Advantech. Firmware is available from Advantech's support portal, and since 1.2.4_20260821 supersedes 1.2.1_20251110 regardless of this specific report, upgrading is low-risk to act on while the CVE assignment is still unresolved.

Sources