Haiwell CVE-2026-19188: unauthenticated root RCE in an HMI gateway

On 14 August 2026, CISA published advisory ICSA-26-225-02 for CVE-2026-19188 in Haiwell IoT Cloud HMI Gateway. Version 3.40.1.12 allows a remote, unauthenticated user to inject an operating-system command through the Net Check feature under /setting. Input carried by the Socket.io cmdPing event reaches the operating system without sufficient neutralisation, and the process executes it with root privileges.

CISA scores the vulnerability 10.0 under both CVSS 4.0 and CVSS 3.1. The vendor identifies 3.50.1.19 as unaffected. At publication, the SSVC assessment recorded no known exploitation but marked the attack automatable with total technical impact. That distinction matters: no confirmed campaign does not reduce the urgency of a mechanism leading directly to root RCE.

When a diagnostic tool becomes a shell

Net Check is intended to let an operator test connectivity to a selected host. Such a feature commonly launches a system utility such as ping and supplies an address entered in the interface. If the application constructs a command string and runs it through a shell, metacharacters can terminate the expected argument and append another command.

In the disclosed flow, input arrives in a cmdPing event over Socket.io. A WebSocket or event-oriented transport provides no automatic protection. The content remains client controlled, and the server must validate its format and launch a process without a shell. The safer pattern is a fixed executable path plus an argument array after parsing a valid IP address or hostname.

The second critical property is missing authentication. An attacker need not compromise an operator account or exploit a weak password. If the interface is reachable, the vulnerable function can be invoked directly. The third property is the root context. A simple management-interface mistake becomes complete device compromise when its process has unrestricted rights.

The chain is therefore network reachability → cmdPing event → shell interpretation → command as root. Each layer should constrain the next: segmentation reduces reachability, authentication controls identity, a safe process API removes injection and least privilege reduces impact. In this case, all four barriers are ineffective.

Why an HMI gateway creates a large blast radius

An HMI gateway sits between operators, cloud services and industrial devices. It may see OT addressing, control protocols, connection configuration and process data. Compromise need not cause immediate process manipulation to be serious. The device can support reconnaissance, traffic observation, persistence and attacks against adjacent systems.

CISA lists critical manufacturing, energy, and water and wastewater among the relevant sectors, with deployments worldwide. Availability and physical safety can outrank conventional confidentiality in these environments. An unplanned restart or update without an operational window can itself cause impact, so response must combine urgency with change control.

Root access enables changes to startup services, network configuration and local monitoring. An attacker can attempt to hide a process, alter firewall rules, replace files or establish a tunnel. Even after firmware is updated, responders must assess whether persistence survived in a data partition or another environment component.

Gateways are often installed by integrators and omitted from central IT inventory. They may run for years with a stable address, password and NAT rule. The first task is therefore not merely clicking an update, but discovering every device, owner, version and connection.

What operators should do

Establish whether the organisation uses Haiwell IoT Cloud HMI Gateway and whether version 3.40.1.12 is present. Review OT asset registers, switch configuration, firewall rules, integrator records and passive network data. Active scanning in an industrial network requires an approved method because some devices respond poorly to aggressive probes.

Obtain the planned update to 3.50.1.19 from the vendor’s official channel. Verify package integrity, back up configuration and define rollback. Test behaviour in a representative environment, and ensure someone familiar with the industrial process is present during the change window. After upgrading, confirm the version and revalidate communication with supervisory systems and field devices.

Until rollout, remove the management interface from the Internet and user networks. Access should traverse a controlled administrative segment, an MFA-protected VPN or a jump host. Permit only required workstations and ports. If Net Check can be disabled without process impact, disable it, but do not treat that as a permanent replacement for the update.

Do not expose the panel through simple port forwarding. Service search engines and automated bots quickly discover stable endpoints. Even a strong password cannot stop a vulnerability reached before authentication.

Checking for compromise

Start with firewall, reverse-proxy, VPN and network-monitoring logs. Look for unexpected requests to /setting, unusual Socket.io sessions and cmdPing sequences from addresses outside approved administration workstations. Calls outside maintenance windows deserve particular attention.

On the device, inspect processes, outbound connections, startup-file changes, accounts, keys and network rules. Compare configuration with an approved backup and firmware with a vendor value where the platform offers a trustworthy verification mechanism. Do not perform analysis in a way that may interrupt control.

Monitor scanning of internal ranges, DNS lookups for new domains, long-lived outbound sessions and traffic between the gateway and systems it did not previously contact. Root RCE can make the device a pivot, so review must include adjacent equipment and integration accounts.

If compromise indicators exist, isolate the device according to the continuity plan. Abrupt disconnection in OT may be as hazardous as leaving an intruder connected. The process operator, security team and technical owner should decide together. Preserve available logs and configuration before reimaging, then rotate related credentials and keys after rebuilding.

Segmentation that actually constrains the attack

A sound design does not allow arbitrary user workstations to initiate connections to an HMI management interface. IT layers, an industrial DMZ, management network and process zones should have explicit flow rules. Outbound traffic from the gateway also requires control; otherwise a compromised appliance can freely establish command-and-control.

An allowlist should derive from documented dependencies. Saying that a gateway needs the Internet is too broad. Identify specific addresses or services, protocols, directions and expected frequency. A departure from that profile can become a high-quality detection signal.

Vendor remote access should not terminate directly on the device. A jump host with session recording, MFA and time-bound privileges provides accountability. Shared accounts and persistent tunnels make it harder to determine who invoked a feature and when.

Operational and diagnostic roles should also be separate. A user who needs process visibility does not necessarily need a feature that launches network utilities. The vendor should enforce authentication, granular roles, safe input handling and a least-privileged process, while an operator can contain consequences before a product change arrives.

Lessons for device engineering and DevSecOps

Launching system commands from interface text is a well-known anti-pattern. Use a direct operating-system API or safe process call with separate arguments instead of a command string. Validate hostnames for length, allowed characters and syntax, and parse IP addresses with a networking library.

Tests must cover event transports, not only ordinary HTTP forms. Socket.io, WebSocket, MQTT and proprietary protocols do not make content trusted. Static analysis should trace data from the event handler to shell-launch functions, while dynamic tests exercise boundary characters without destructive execution.

A web process rarely needs root. If one diagnostic operation requires a specific privilege, a small helper with a narrow interface, system profile and audit trail is safer. A container is not sufficient when it runs privileged or has host-network access.

Secure by default also means no public management exposure, enforced authentication at initial setup, signed updates and a clear security history. Industrial appliances are software maintained over many years, so patch delivery is part of the security model rather than an optional feature.

Facts, conclusions and priority

ICSA-26-225-02 establishes that version 3.40.1.12 is vulnerable, exploitation requires no authentication, commands run as root and version 3.50.1.19 is identified as unaffected. It also records a CVSS score of 10.0 and no confirmed exploitation at publication. That final point is not assurance that a particular device was never attacked later or locally.

Breachroad’s conclusion is that this CVE should test OT asset-management maturity. An organisation unable to quickly enumerate gateways, versions and communication paths has a broader problem than a single missing update. Patching closes this known flaw; segmentation, egress control and independent monitoring constrain the next one as well.

If you need a review of segmentation, device exposure and administrative access, see our IT security assessment. Operators, integrators and maintenance teams should also consider cybersecurity training for organisations so that decisions under incident pressure have been rehearsed in advance.