---
schema: 1
kind: vulnerability
title: "CVE-2026-19188 — Haiwell IoT Cloud HMI Gateway: the diagnostic ping in the web interface runs attacker-supplied shell commands as root, unauthenticated (CVSS 10.0)"
headline: "CISA publishes a maximum-severity, CISA-assessed-automatable command injection in an HMI gateway deployed across energy, water and manufacturing"
summary: >
  CISA advisory ICSA-26-225-02 discloses CVE-2026-19188 in the Haiwell IoT Cloud HMI Gateway: the Net Check
  diagnostic reachable at the /setting endpoint passes the cmdPing argument to the operating system without
  sanitisation, so a remote unauthenticated attacker executes arbitrary commands as root. CVSS 3.1 base 10.0,
  version 3.40.1.12 affected, fixed in Scada-v3.50.1.19. CISA reports the product deployed worldwide in energy,
  critical manufacturing and water and wastewater, records no known exploitation, and assesses it automatable.
discovered_at: "2026-08-15T04:51:00Z"
event_date: "2026-08-13"
run_id: 2026-08-15T0412Z-intel
priority: high
immediate_action: null
tags:
  - vulnerabilities
  - rce
  - pre-auth
  - ot-ics
  - patch-available
  - default-config
regions:
  - global
sectors:
  - energy
  - water
  - manufacturing
entities: []
techniques: [T1190]
affected_products:
  - Haiwell IoT Cloud HMI Gateway
cves:
  - id: CVE-2026-19188
    cvss: "10.0"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status:
      - patch-available
    affected: "3.40.1.12"
    fixed: "Scada-v3.50.1.19"
sources:
  - url: "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-225-02.json"
    publisher: "CISA — ICS advisory ICSA-26-225-02 (CSAF)"
    date: "2026-08-13"
    role: primary
closed_sources: []
evidence:
  - quote: "The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges"
    publisher: "CISA — ICS advisory ICSA-26-225-02"
  - quote: "Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges."
    publisher: "CISA — ICS advisory ICSA-26-225-02"
verification: single-source
sourcing_note: >
  CISA is the disclosing authority and the only party to have published on the flaw. The advisory is cited
  from CISA's own structured CSAF mirror because its human-readable page was unreachable from this environment,
  so the entry is marked single-source rather than claiming the national-CERT carve-out on a mirror host. The structured CSAF record is the source for the CVSS score, the affected
  and fixed versions and the sector and deployment statements. The vendor's own advisory was not located.
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Determine whether any Haiwell IoT Cloud HMI Gateway in the estate answers on a routable address, and take its management interface off any network reachable without a VPN before scheduling the upgrade to Scada-v3.50.1.19 — the flaw needs no credential and no user interaction, so reachability is the entire precondition."
migrated_from: null
---

CISA published ICS advisory ICSA-26-225-02 on 2026-08-13 for CVE-2026-19188, an OS command injection (CWE-78) in the Haiwell IoT Cloud HMI Gateway, a human-machine-interface gateway from a China-headquartered vendor that CISA reports deployed worldwide across the energy, critical manufacturing, and water and wastewater sectors. The advisory places the defect in the gateway's Net Check diagnostic feature, reachable via the `/setting` endpoint: the `cmdPing` Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, so an attacker injects and executes arbitrary OS commands with root privileges ([CISA, 2026-08-13](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-225-02.json)). CISA scores it CVSS 3.1 base 10.0 with the vector `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — network-reachable, low complexity, no privileges, no user interaction, and a scope change reflecting that the injected commands run outside the web application's own boundary.

Two properties in the structured record decide the urgency, and neither is the score. The advisory's SSVC decision data records exploitation as none observed but automatability as yes — CISA's assessment that the steps from reconnaissance through exploitation can be reliably scripted against every reachable instance ([CISA, 2026-08-13](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-225-02.json)). A no-credential, no-interaction root primitive that a script can find and fire at scale does not stay unexploited because nobody has tried yet; it stays unexploited until somebody writes the loop. The second is remediation shape: only version 3.40.1.12 appears in the affected list, and Haiwell's fix is patch version Scada-v3.50.1.19, published as a download on the vendor's own site rather than as a firmware push, so applying it is an operator action on each unit ([CISA, 2026-08-13](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-225-02.json)). CISA's standing guidance in the same advisory is to minimise network exposure for control-system devices, keep them off the internet, place them behind firewalls isolated from business networks, and use more secure methods such as a VPN where remote access is required.

For a defender the exposure question is sharper than the patch question, because an HMI gateway exists to be reached remotely — that is its product function, and the diagnostic ping is a feature an operator is meant to use. Detection concepts, telemetry class first: in network telemetry at the perimeter and in front of the OT segment, surface any inbound session to the gateway's management interface from outside the expected engineering-access source ranges, and specifically WebSocket or Socket.io connections carrying `cmdPing` events whose host argument contains shell metacharacters — a semicolon, pipe, backtick or command-substitution syntax where a hostname or address belongs. On the device or in any host telemetry available from it, a root-owned process spawned by the gateway service other than the ping utility it legitimately invokes is the post-exploitation signal, as is an outbound connection initiated by the gateway process shortly after inbound management traffic — an OT gateway that starts calling out immediately after being asked to run a diagnostic is not doing what it was asked.

**Triage:** the Net Check feature genuinely spawns a ping process when an engineer uses it, so process creation from the gateway service is not by itself the discriminator. What separates the two is the argument and the source: a legitimate diagnostic carries a bare hostname or IP address from an engineering workstation inside the maintenance path, while the exploited call carries shell syntax in the same field and arrives from outside that path — and the resulting process is something other than the ping binary.