RCE in Advantech Wise-6610
CVE-2026-2670
A vulnerability was identified in Advantech WISE-6610 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.163 (96.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Advantech Wise-6610 — versions 1.2.1_20251110
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (issue-tracking, exploit)
- cna@vuldb.com (product)
Frequently asked questions
- What is CVE-2026-2670?
- CVE-2026-2670 is a high-severity vulnerability in Advantech Wise-6610, classified under Command Injection. CVSS score: 7.2/10. Published 2026-02-18.
- How severe is CVE-2026-2670?
- High severity. CVSS v3 base score is 7.2 out of 10.