Vulnerability · Published Aug 14, 2026 · Assigned by icscert

CVE-2026-19188Haiwell IoT Cloud HMI Gateway OS Command Injection

Critical 10.0

In plain English

A critical-severity OS command injection in Haiwell IoT Cloud HMI Gateway from Haiwell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)2.9%top 12.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.

Affected products (as reported)

Vendor	Product	Versions
Haiwell	Haiwell IoT Cloud HMI Gateway	3.40.1.12

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References