CISA published ICSA-26-225-02 on August 13, alongside 14 other industrial control system advisories, but one entry in that batch stands out for the worst possible reason: a perfect CVSS score. CVE-2026-19188, affecting the Haiwell IoT Cloud HMI Gateway, scores 10.0 under both CVSS v3.1 and v4.0 — the maximum on the scale, reserved for flaws that are remotely exploitable, require no authentication, no user interaction, and grant complete compromise of confidentiality, integrity, and availability.
Haiwell’s IoT Cloud HMI Gateway is marketed as a combined HMI, IIoT gateway, and DTU (data transfer unit) — a three-in-one device that sits between field-level PLCs and cloud or SCADA infrastructure, commonly deployed in remote monitoring setups for pump stations, distributed energy assets, and manufacturing lines where a full SCADA server isn’t justified. That gateway role — bridging OT devices directly to internet-facing cloud connectivity — is precisely what makes this vulnerability class so dangerous in ICS environments.
Technical Details
The flaw lives in the gateway’s Net Check feature, exposed through the /setting endpoint. This diagnostic feature lets an operator trigger a network connectivity test — effectively a ping utility built into the web management interface. The implementation uses a Socket.io event named cmdPing to accept the target host or IP address from the client and pass it to the underlying operating system’s ping command.
The vulnerability (CWE-78, OS Command Injection) exists because the cmdPing handler fails to sanitize or validate the user-supplied input before it is concatenated into a shell command. An attacker who can reach the Socket.io interface — which requires no authentication — can inject shell metacharacters into the “host” parameter to append arbitrary operating system commands. Because the underlying gateway process runs with root privileges, whatever command the attacker injects executes with full root access on the device.
The CVSS 3.1 vector — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — captures the severity precisely: network-exploitable, low attack complexity, no privileges required, no user interaction, scope change, and complete impact on confidentiality, integrity, and availability. The scope change (S:C) reflects that compromising the gateway process gives an attacker control beyond the vulnerable component itself — namely, the underlying host operating system and, from there, whatever the gateway is bridged to.
Why This Matters for OT
Unlike vulnerabilities buried deep in an engineering workstation or requiring an attacker to already have network segment access, this flaw is exploitable from wherever the gateway’s web interface is reachable. Given that IoT gateways of this class are frequently deployed for remote-site connectivity — exactly the use case where operators expose management interfaces to the internet or to lightly segmented cellular/VPN links for ease of monitoring — the practical attack surface is significant. Search-engine reconnaissance tools like Shodan and Censys routinely surface HMI and gateway web panels with default or minimal authentication; a device family with an unauthenticated root-level command injection sitting behind that same interface is a textbook target for opportunistic scanning campaigns, not just targeted nation-state operations.
Root access on the gateway itself is the more immediate concern. From there, an attacker inherits whatever Modbus, DNP3, or proprietary polling logic the gateway uses to talk to downstream PLCs and RTUs — enabling manipulation of the data the gateway reports upstream to cloud dashboards or SCADA historians, injection of falsified telemetry, or use of the compromised device as a pivot point into the OT network segment it was meant to bridge safely. For water and wastewater utilities and distributed energy operators who rely on this class of gateway precisely because it eliminates the need for a full-scale RTU or SCADA server at every remote site, that pivot risk is the whole point of the device’s existence turned against them.
CISA’s advisory lists the affected sectors as Energy, Critical Manufacturing, and Water and Wastewater, with deployment reported worldwide — consistent with the product’s positioning as a low-cost remote monitoring gateway for exactly those sectors’ distributed assets (well pads, lift stations, remote power infrastructure, and unattended manufacturing lines).
Remediation
Haiwell has released version Scada-v3.50.1.19, which resolves the flaw; the affected version documented in the advisory is 3.40.1.12. Asset owners should:
- Identify all Haiwell IoT Cloud HMI Gateway deployments and confirm firmware version; upgrade to 3.50.1.19 or later immediately.
- Remove the gateway’s web management interface from direct internet exposure. If remote access is operationally required, place it behind a VPN with strong authentication rather than a direct port-forward or cloud-facing exposure.
- Audit outbound and inbound connections from these gateways for anomalous shell activity, unexpected outbound connections, or new processes spawned by the gateway’s web service — indicators that the
cmdPingpath has already been exploited. - Apply network segmentation so that even a fully compromised gateway cannot reach engineering workstations, historian servers, or other high-value OT assets without passing through additional monitored chokepoints.
- Where the device cannot be patched promptly, disable or restrict access to the Net Check / diagnostic feature at the network layer if the vendor does not provide a way to disable it directly.
The researcher credited with reporting the flaw to CISA is Fiqram Akmal. As with prior maximum-severity ICS advisories, the combination of trivial exploitability and internet-reachable deployment patterns means this vulnerability is likely to draw fast attention from both security researchers running mass scans and opportunistic threat actors — patching should be treated as urgent rather than scheduled into a routine maintenance window.