CISA flags critical Haiwell HMI Gateway flaw; patch available

By Atlas Watchline Staff · Regulatory · August 13, 2026

CISA says a critical command-injection flaw in Haiwell IoT Cloud HMI Gateway could let an attacker run operating-system commands with root access, and Haiwell has released a patch.

CISA on Aug. 13 said a critical vulnerability in Haiwell IoT Cloud HMI Gateway could let an attacker run operating-system commands with root privileges on affected devices.

CISA said the product is deployed worldwide and is used in sectors including Energy, Critical Manufacturing, and Water and Wastewater. The agency assigned the issue CVE-2026-19188 and rated it critical under both CVSS v3.1 and CVSS v4.0, with base scores of 10.

According to CISA, the flaw affects Haiwell IoT Cloud HMI Gateway version 3.40.1.12 and is linked to the Net Check feature exposed through the /setting endpoint. CISA said the cmdPing Socket.io event does not properly sanitize user input before sending it to the operating system, which could allow command injection. The agency also classified the issue as CWE-78, or improper neutralization of special elements used in an operating-system command.

CISA said Haiwell has addressed the issue in patch version Scada-v3.50.1.19, which is available from Haiwell’s website. The advisory lists Haiwell’s headquarters as China and marks the product status as known affected.

The agency said no known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. CISA credited Fiqram Akmal with reporting the vulnerability.

For operators that use the affected product, the next step is to review the advisory and apply the patch version named by CISA.

Sources

• CISA advisory: ICSA-26-225-02

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.