Is CVE-2026-19188 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-19188

Users should upgrade to Haiwell IoT Cloud HMI Gateway patch version Scada-v3.50.1.19 or later. CISA recommends minimizing network exposure for all control system devices and ensuring they are not accessible from the internet. Control system networks and remote devices should be located behind firewalls and isolated from business networks. When remote access is required, use more secure methods such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. Organizations should perform proper impact analysis and risk assessment prior to deploying defensive measures.

Quick answers

What is CVE-2026-19188?: Users should upgrade to Haiwell IoT Cloud HMI Gateway patch version Scada-v3.50.1.19 or later. CISA recommends minimizing network exposure for all control system devices and ensuring they are not accessible from the internet. Control system networks and remote devices should be located behind firewalls and isolated from business networks. When remote access is required, use more secure methods such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. Organizations should perform proper impact analysis and risk assessment prior to deploying defensive measures.
How severe is CVE-2026-19188?: critical, CVSS 10
Is CVE-2026-19188 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-19188 be mitigated?

Critical OS Command Injection Vulnerability Discovered in Haiwell IoT Cloud HMI Gateway

A critical command injection vulnerability (CVE-2026-19188) has been identified in the Haiwell IoT Cloud HMI Gateway product. The flaw exists in the Net Check feature accessible via the /setting endpoint, where the cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system. Successful exploitation may allow an attacker to inject and execute arbitrary OS commands with root privileges. The vulnerability affects Haiwell IoT Cloud HMI Gateway version 3.40.1.12 and earlier. Haiwell has addressed the issue in patch version Scada-v3.50.1.19. The vulnerability has been reported to CISA by Fiqram Akmal. No known public exploitation has been reported to CISA at the time of publication. The vulnerability is classified as critical with CVSS scores of 3.1 and 4.0. Affected sectors include Energy, Critical Manufacturing, and Water and Wastewater.

32m

CVE-2026-19188

Quick answers

Related News

Critical OS Command Injection Vulnerability Discovered in Haiwell IoT Cloud HMI Gateway