Haiwell HMI Gateway flaw allows root command injection
An unpatched OS command injection bug in Haiwell IoT Cloud HMI Gateway lets attackers run root-level commands via a Socket.io endpoint.
CISA has published an advisory detailing a critical OS command injection vulnerability (CVE-2026-19188) in Haiwell IoT Cloud HMI Gateway version 3.40.1.12. The flaw resides in the Net Check feature reachable through the /setting endpoint, where the cmdPing Socket.io event fails to sanitize user-supplied input before passing it to the underlying OS, enabling arbitrary command execution with root privileges (CWE-78).
Haiwell, a China-headquartered vendor, ships this gateway product to energy, critical manufacturing, and water/wastewater sectors worldwide. Haiwell has released patch Scada-v3.50.1.19 to address the issue. CISA states no known public exploitation has been observed at this time, and recommends standard ICS network segmentation, firewalling, and VPN best practices for organizations unable to immediately patch.
Mentioned in this report
Detection guidance
Haiwell HMI Gateway Abnormal Process Spawning from Web Service
Detects shell or command interpreter spawned by Haiwell HMI Gateway daemon process (typical PID typically haiwell-related binary), indicative of successful command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Haiwell HMI Gateway Abnormal Process Spawning from Web Service
description: Detects shell or command interpreter processes spawned by Haiwell HMI
Gateway daemon, indicating successful OS command injection via CVE-2026-19188. Generalises
on parent process (HMI Gateway daemon) spawning unusual child interpreter (sh, bash,
cmd, powershell) rather than matching specific payload commands.
tags:
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- haiwell
- gateway
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
filter_admin_tools:
CommandLine|contains:
- systemctl
- service
- apt
- dpkg
condition: selection_parent and selection_child and not filter_admin_tools
falsepositives:
- Haiwell legitimate internal scripts invoking shell for system diagnostics
- Administrator maintenance scripts executed from HMI application context
level: high
id: d2d810f1-38d7-5a71-8051-a4cf1e84a9a0
status: experimental
author: Vorant
Haiwell HMI Gateway Root-Privilege Command Execution Detection
Detects command execution with root/elevated privileges originating from Haiwell HMI Gateway process context, consistent with CVE-2026-19188 exploitation outcome. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Haiwell HMI Gateway Root-Privilege Command Execution Detection
description: Detects commands executed with root privileges spawned from Haiwell HMI
Gateway daemon process context. Exploitation of CVE-2026-19188 yields root-level
arbitrary command execution; this rule flags the privilege elevation anomaly rather
than specific payloads.
tags:
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- haiwell
- gateway
User: root
Image|endswith:
- /sh
- /bash
- /nc
- /ncat
- /wget
- /curl
filter_expected_admin:
CommandLine|contains:
- update
- restart
- restart-service
condition: selection and not filter_expected_admin
falsepositives:
- Haiwell deployment scripts that legitimately run system commands as root during
installation/updates
- Authorized infrastructure automation calling HMI Gateway APIs for infrastructure
management
level: high
id: 24423585-7702-541c-81af-c59ed99d0bd9
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-02
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free