Critical OS Command Injection Vulnerability Discovered in Haiwell IoT Cloud HMI Gateway

A critical operating system command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product, tracked as CVE-2026-19188. According to the advisory published by CISA, the flaw exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system. Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges. The affected product versions include Haiwell IoT Cloud HMI Gateway 3.40.1.12 and earlier releases. Haiwell has addressed the vulnerability in patch version Scada-v3.50.1.19, which is available for download from the vendor's website. The vulnerability carries CVSS scores of 3.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), both classified as critical severity. The vulnerability affects critical infrastructure sectors including Energy, Critical Manufacturing, and Water and Wastewater. The affected product is deployed worldwide, with company headquarters located in China. The vulnerability was reported to CISA by Fiqram Akmal. At the time of publication, no known public exploitation specifically targeting this vulnerability has been reported to CISA. CISA recommends that users minimize network exposure for all control system devices and ensure they are not accessible from the internet. Control system networks and remote devices should be located behind firewalls and isolated from business networks. When remote access is required, more secure methods such as virtual private networks (VPNs) should be used, and VPNs should be updated to the most current version available.