CVE-2026-19188
View CSAF Summary Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges. The following versions of Haiwell IoT Cloud HMI Gateway are affected: Haiwell IoT Cloud HMI Gateway 3.40.1.12 (CVE-2026-19188) CVSS Vendor Equipment Vulnerabilities v3 10 Haiwell Haiwell IoT Cloud HMI Gateway Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Background Critical Infrastructure Sectors: Energy, Critical Manufacturing, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-19188 A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges View CVE Details Affected Products Haiwell IoT Cloud HMI Gateway Vendor: Haiwell Product Version: Haiwell Haiwell IoT Cloud HMI Gateway: 3.40.1.12 Product Status: known_affected Remediations Mitigation Haiwell has addressed the issue in patch version number Scada-v3.50.1.19, which is available for download on their website: https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361 https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361 Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Metrics CVSS Version Base Score Base Severity Vector String 3.1 10 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 4.0 10 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Acknowledgments Fiqram Akmal reported this vulnerability to CISA Legal Notice and Terms of Use This
CSIRTS triage
- What
- OS command injection vulnerability in the Net Check feature's cmdPing Socket.io event allows arbitrary OS command execution with root privileges.
- Who is affected
- Haiwell IoT Cloud HMI Gateway version 3.40.1.12 deployments in energy and water critical infrastructure worldwide.
- Urgency
- Immediate; CVSS 10.0 (critical) with unauthenticated remote code execution as root via the /setting endpoint.
- Action
- Update Haiwell IoT Cloud HMI Gateway to a patched version addressing CVE-2026-19188.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-19188
Get an email if CVE-2026-19188 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Moderate exploitation risk1.9% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 78% of all EPSS-scored CVEs.
Advisory coverage (2)
- criticalCVE-2026-19188: A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI…nvd · 2026-08-14
- criticalHaiwell IoT Cloud HMI Gatewaycisa · 2026-08-13
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-19188)