Haiwell vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Haiwell products: 1 record(s), with severity, exploitation and fixes.

Haiwell IoT Cloud HMI Gateway 1

Exploited only (KEV) →

CVE-2026-19188 Critical · 10.0 CWE-78 Aug 14, 2026

Haiwell IoT Cloud HMI Gateway OS Command Injection

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.