External risk intelligence

Haiwell IoT Cloud HMI Gateway OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-19188

The vulnerability affects an IoT Gateway, which is a device specifically designed to bridge local industrial or IoT networks with external networks. Given its role as a gateway and its accessibility via a web-based endpoint, such devices are commonly deployed in configurations where they are reachable from the internet to facilitate remote management and data monitoring.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been found in Haiwell's IoT Cloud HMI Gateway, specifically within its Net Check feature. This vulnerability allows unauthorized access and execution of system commands with the highest level of privilege, posing a significant risk to the integrity and control of connected systems.

Unauthenticated attackers can run any command on the gateway.
It impacts industrial control and IoT systems accessed remotely.
Confirming relevance and exposure is the primary leadership concern.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by sending specially crafted network requests to the Haiwell IoT Cloud HMI Gateway. The Net Check feature, accessible through the /setting endpoint, processes user input via the cmdPing Socket.io event without adequate validation. This allows an attacker to inject operating system commands, which are then executed with root privileges.

Network access required
Net Check feature input
Arbitrary code execution

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary operating system commands with root privileges on the Haiwell IoT Cloud HMI Gateway. This risk is present when the "Net Check" feature, accessed via the `/setting` endpoint, is exposed to the network and the `cmdPing` event fails to validate user input.

Affected system: Haiwell IoT Cloud HMI Gateway.
Exposure: Network-accessible "Net Check" feature.
Consequence: Arbitrary command execution with root privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Haiwell IoT Cloud HMI Gateway's "Net Check" feature is susceptible to OS command injection, allowing unauthenticated attackers to execute arbitrary commands with root privileges. This critical vulnerability necessitates immediate attention from teams responsible for the security and operation of these gateways. The first practical step is to identify all instances of the affected HMI Gateway, determine their network exposure and business criticality, and locate the designated owner for remediation planning.

Ownership: Infrastructure or IoT platform teams.
Verify: Gateway reachability and criticality.
Action: Plan coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Haiwell IoT Cloud HMI Gateway?

The Haiwell IoT Cloud HMI Gateway is an industrial device used to bridge local IoT or machine networks with external systems. It functions as an interface for remote monitoring and management of industrial processes, helping to bridge the gap between field-level data and cloud-based applications.

What does CVE-2026-19188 mean by OS command injection?

This vulnerability, classified as CWE-78, occurs when software fails to clean user input before using it to trigger operating system commands. In this case, the gateway's 'Net Check' feature blindly runs input provided by a user. An attacker can use this to 'inject' their own malicious commands, which the device then executes with full root privileges, effectively granting them total control over the gateway.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending a crafted network request to the '/setting' endpoint on the gateway. The attack specifically leverages the 'cmdPing' Socket.io event. Simply browsing to the device dashboard or using unrelated features will not trigger this; the input must be sent specifically through that functional path.

Is my device relevant to this threat?

If you manage a Haiwell IoT Cloud HMI Gateway, you should consider it relevant. Halo Surface Signal indicates these gateways are often placed in configurations reachable from the internet to support remote management. If your device is accessible over the network, it is a potential target for this flaw.

What is the first step to address this issue?

Your priority is to identify every instance of the Haiwell IoT Cloud HMI Gateway within your environment. Once mapped, confirm whether each device is reachable over the network and determine its business criticality. Use this information to coordinate with the appropriate infrastructure or IoT teams to plan for remediation and limit unauthorized access to the affected gateway.

References

www.cisa.gov/news-events/ics-advisories/icsa-26-225-02

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.