Command Injection in Advantech WISE-6610 Series

Executive Summary

This vulnerability is a command injection flaw in Advantech WISE-6610 series devices running Node-RED Library version 1.2.1_20251110. It allows remote attackers to execute arbitrary commands by manipulating the 'act' argument in the nodered_lib_apply function. A patch is available in version 1.2.4_20260821.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves command injection in the Node-RED Library function nodered_lib_apply. To detect it, check if your Advantech WISE-6610 device is running version 1.2.1_20251110 or earlier. Use commands like 'curl -X GET http://<device-ip>/api/version' to verify the firmware version. Inspect Node-RED flows for suspicious 'act' parameter usage in HTTP requests.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain control of the affected device, steal sensitive data, disrupt operations, or use it as a pivot point to attack other systems. The high CVSS scores indicate severe impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote command injection via manipulation of the 'act' argument in the Node-RED Library function, which could lead to unauthorized access or data exfiltration. This could potentially violate GDPR's data protection requirements or HIPAA's security rules if sensitive data is exposed or altered.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the affected Advantech WISE devices to version 1.2.4_20260821 or later to resolve the command injection vulnerability in the Node-RED Library component.

Useful 0 Not Useful 0