Critical flaw in Advantech industrial gateways lets attackers become root over the network

A newly disclosed vulnerability in a range of Advantech WISE-6610 industrial gateways has been rated 9.9 out of 10 on the CVSS severity scale - about as bad as these things get. The catch, as ever with critical-sounding CVEs, is that this affects a specific family of industrial networking kit, not your home router or laptop.

What the bug actually does

The flaw, tracked as CVE-2026-79698, sits in a function called nodered_lib_apply inside the gateway’s backend management interface. According to the technical writeup behind the disclosure, the device takes an act parameter from a POST request and, when it’s set to delete, passes attacker-controlled input straight into a system command without sanitising it first.

In plain terms: send the box a booby-trapped web request, and rather than deleting a file as intended, you can smuggle in arbitrary commands that run with root privileges - the highest level of access on the device. A successful attacker could reconfigure the gateway, plant a backdoor, intercept or alter network traffic passing through it, or simply brick the thing outright.

The researchers say they reproduced the attack against a live-looking target, and it’s worth noting the login used was the default admin / admin combination - a reminder that plenty of industrial kit still ships, or gets deployed, without anyone bothering to change the factory password.

So who is actually at risk

This affects Advantech’s WISE-6610 line of industrial IoT gateways - devices sold across variants including the NB, EB, TB, JB, CB and “EL” sub-models, all covered by the same CVE entry. These are the kind of boxes used to network sensors, machinery and remote sites in factories, utilities and similar industrial settings - not consumer or typical office equipment.

If you don’t run industrial or operational technology, this isn’t your problem. If your organisation does use WISE-6610 gateways, though, a 9.9 severity score paired with root-level remote command execution is about as serious as vulnerability disclosures come, and it deserves attention rather than a shrug.

What we don’t yet know matters just as much as what we do. Advantech’s own security advisory and patch status aren’t detailed in what’s been published so far, so it isn’t confirmed whether a fix is already available, is on the way, or has yet to be worked out. There’s also no evidence in the disclosure of this being actively exploited in the wild - the reproduction described looks like researcher testing against a reachable device, not a documented real-world attack. And there’s no public figure for how many of these gateways are actually deployed and internet-facing, which is the detail that turns a scary CVSS number into either a genuine emergency or a niche advisory.

What to do about it

If you administer WISE-6610 gateways, the sensible steps are the boring ones: check Advantech’s firmware support page for an update, change any default admin credentials immediately, and avoid exposing the management interface directly to the internet if at all possible.

For everyone else, this is a useful case study rather than a reason to worry. A 9.9 score grabs headlines, but severity ratings describe how bad an exploit could be in theory, not how many people it’s actually going to hit. Until there’s confirmation of a patch, of exploitation, or of a plausible number of exposed devices, this is one to watch from the sidelines rather than panic over.