A ping box in Haiwell's HMI gateway hands out root, and the fix ships under another name

CISA published advisory ICSA-26-225-02 on 13 August 2026, covering CVE-2026-19188 in Haiwell IoT Cloud HMI Gateway version 3.40.1.12 ^[1][2]. Successful exploitation may allow an attacker to inject and execute arbitrary operating system commands with root privileges ^[3], on a product CISA lists as deployed worldwide across the energy, critical manufacturing, and water and wastewater sectors ^[4][5].

The mechanism is mundane, which is the point. The flaw sits in the Net Check feature reachable through the /setting endpoint, where the cmdPing Socket.io event does not properly sanitise user-supplied input before handing it to the underlying operating system ^[6]. CISA files it under CWE-78, improper neutralisation of special elements used in an OS command ^[7]. A diagnostic ping field wired straight into a shell is one of the oldest defects in embedded gear, and root is the default because these gateways rarely bother to drop privileges.

Two operational details follow from the shape of it. Because the trigger is a Socket.io event rather than a plain HTTP query parameter ^[6], teams that expect to spot command injection in web server request logs or in URL-inspecting middleboxes should verify that their tooling actually decodes the websocket traffic. And because the vulnerable feature is a network check tool, it is exactly the sort of page a commissioning engineer leaves reachable.

What the advisory does not say is worth naming. The metrics section of the text CISA published carries no CVSS score or vector ^[8], and the advisory does not state whether authentication is required to reach the /setting endpoint or to emit the cmdPing event ^[9]. Until Haiwell or CISA says otherwise, the defensible assumption is that anyone with network reach to the device is in scope. The vulnerability was reported to CISA by Fiqram Akmal ^[10], and CISA says no known public exploitation specifically targeting it has been reported to the agency at this time ^[11].

The remediation carries its own friction. Haiwell has addressed the issue in patch version Scada-v3.50.1.19, downloadable from the vendor's site ^[12]. That is not a point release on the affected line: the fixed build changes the version family from 3.40 to 3.50 and adds a Scada- prefix the affected version string does not have ^[13]. Asset inventories and CMDB entries keyed to "IoT Cloud HMI Gateway 3.40.x" will not match cleanly against a Scada-v3.50 build, and neither will vulnerability scanner fingerprints written against the old string. Expect to reconcile that by hand. In the meantime CISA's guidance is the usual perimeter work: minimise network exposure, keep control system devices off the internet, put control networks and remote devices behind firewalls and isolated from business networks, and use VPNs for remote access while recognising that a VPN is only as secure as the devices connected to it ^[14].

Watch for a revision to the advisory adding CVSS metrics and an authentication prerequisite, since both determine how hard operators need to push the change window ^[8][9]. Watch for the vendor to publish a mapping between the gateway version line and the Scada build line, because the rename is the part most likely to leave devices unpatched on paper and in fact ^[13]. And watch the exploitation status, which is currently clean only as far as reports to CISA go ^[11].