Haiwell HMI Gateway flaw allows root command injection
An unpatched OS command injection bug in Haiwell IoT Cloud HMI Gateway lets attackers run root-level commands via a Socket.io endpoint.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an advisory detailing a critical OS command injection vulnerability (CVE-2026-19188) in Haiwell IoT Cloud HMI Gateway version 3.40.1.12. The flaw resides in the Net Check feature reachable through the /setting endpoint, where the cmdPing Socket.io event fails to sanitize user-supplied input before passing it to the underlying OS, enabling arbitrary command execution with root privileges (CWE-78).
Haiwell, a China-headquartered vendor, ships this gateway product to energy, critical manufacturing, and water/wastewater sectors worldwide. Haiwell has released patch Scada-v3.50.1.19 to address the issue. CISA states no known public exploitation has been observed at this time, and recommends standard ICS network segmentation, firewalling, and VPN best practices for organizations unable to immediately patch.
Mentioned in this report
Detection guidance
Haiwell HMI Gateway Abnormal Process Spawning from Web Service
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects shell or command interpreter spawned by Haiwell HMI Gateway daemon process (typical PID typically haiwell-related binary), indicative of successful command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Haiwell HMI Gateway Abnormal Process Spawning from Web Service
description: Detects shell or command interpreter processes spawned by Haiwell HMI
Gateway daemon, indicating successful OS command injection via CVE-2026-19188. Generalises
on parent process (HMI Gateway daemon) spawning unusual child interpreter (sh, bash,
cmd, powershell) rather than matching specific payload commands.
tags:
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- haiwell
- gateway
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ksh
filter_admin_tools:
CommandLine|contains:
- systemctl
- service
- apt
- dpkg
condition: selection_parent and selection_child and not filter_admin_tools
falsepositives:
- Haiwell legitimate internal scripts invoking shell for system diagnostics
- Administrator maintenance scripts executed from HMI application context
level: high
id: d2d810f1-38d7-5a71-8051-a4cf1e84a9a0
status: experimental
author: Vorant
Haiwell HMI Gateway Root-Privilege Command Execution Detection
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command execution with root/elevated privileges originating from Haiwell HMI Gateway process context, consistent with CVE-2026-19188 exploitation outcome. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Haiwell HMI Gateway Root-Privilege Command Execution Detection
description: Detects commands executed with root privileges spawned from Haiwell HMI
Gateway daemon process context. Exploitation of CVE-2026-19188 yields root-level
arbitrary command execution; this rule flags the privilege elevation anomaly rather
than specific payloads.
tags:
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- haiwell
- gateway
User: root
Image|endswith:
- /sh
- /bash
- /nc
- /ncat
- /wget
- /curl
filter_expected_admin:
CommandLine|contains:
- update
- restart
- restart-service
condition: selection and not filter_expected_admin
falsepositives:
- Haiwell deployment scripts that legitimately run system commands as root during
installation/updates
- Authorized infrastructure automation calling HMI Gateway APIs for infrastructure
management
level: high
id: 24423585-7702-541c-81af-c59ed99d0bd9
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-02
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs