01 Record

CVE-2026-19188

Haiwell IoT Cloud HMI Gateway OS Command Injection

CriticalPUBLISHEDCNA: icscert

Base score10.0 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

View raw JSON CVE Program record

02 Description

Haiwell IoT Cloud HMI Gateway OS Command Injection

03 Metadata

Published: 2026-08-14 18:20Z2 HR AGO
Last updated: 2026-08-14 18:52Z1 HR AGO
Reserved: 2026-08-06
Assigning CNA: icscert
Record state: PUBLISHED
Severity: Critical (CVSS 10.0)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses: CWE-78
SSVC decision: ExploitationnoneAutomatableyesTechnical Impacttotal
Data version: 5.2
Document digest: 66885a42dea440cb616e2fbb2036a7d84bb78f19aa0d7eb05d06502d1a252ab3

04 Affected products

VendorProductVersionsPlatforms

HaiwellHaiwell IoT Cloud HMI Gateway3.40.1.12—

05 References

06 Remediation

Haiwell has addressed the issue in patch version number Scada-v3.50.1.19, which is available for download on their website: https://en.haiwell.com/app/system/entrance.php?m=include&c=access&a=dodown&lang=en&id=361