Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Advantech WISE-6610 devices allow remote command execution

CVE-2026-79697 · published 1 month ago
Summary

Several Advantech WISE-6610 models can be tricked into running unwanted commands when a remote user supplies specially crafted data to the basicstation_apply function. This could let an attacker take control of the device. Updating the firmware to version 1.2.4_20260821 resolves the issue, so apply the upgrade as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
advantech wise-6610-nb 1.2.1_20251110
advantech wise-6610-eb 1.2.1_20251110
advantech wise-6610-tb 1.2.1_20251110
advantech wise-6610-jb 1.2.1_20251110
advantech wise-6610-cb 1.2.1_20251110
advantech wise-6610-el-nb 1.2.1_20251110
advantech wise-6610-el-eb 1.2.1_20251110
advantech wise-6610-el-tb 1.2.1_20251110
advantech wise-6610-el-jb 1.2.1_20251110
advantech wise-6610-el-cb 1.2.1_20251110
advantech wise-6610p-dea 1.2.1_20251110
advantech wise-6610p-dna 1.2.1_20251110
advantech wise-6610p-dta 1.2.1_20251110
Original advisory text
Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.6 High
Exploitation
5% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-74Injection
Timeline
Published7 Sep 2026
Updated7 Oct 2026
First seen8 Sep 2026
Sources
CVE-2026-79697 · NVD
CVE-2026-79697 · MITRE
Track software like this
Free during beta