Advantech WISE-6610: two CVSS 9.9 flaws in a LoRa gateway

Two command injection vulnerabilities in the Advantech WISE-6610 industrial LoRaWAN gateway were published on September 7, both scored CVSS 9.9. The Advantech WISE-6610 command injection flaws are remotely reachable, and the fixed firmware has been available since August. The interesting part is not the bugs. It is that this is a class of device most small operators do not know is on their network, because a systems integrator installed it and left.

What actually happened

Both CVEs land in the gateway's web management layer, and both work the same way — an act argument passed to a shell without sanitisation:

• CVE-2026-79697 — the basicstation_apply function in the Basic Station certificate-deletion handler
• CVE-2026-79698 — the nodered_lib_apply function in the Node-RED Library component

The CVE record lists CVSS 3.1 of 9.9 (CVSS 4.0: 9.4), remote attack vector, published September 7, 2026. Thirteen model variants are affected — the NB, EB, TB, JB, and CB units, the EL series, and the P-series DEA/DNA/DTA models — all on firmware 1.2.1_20251110. Upgrading to 1.2.4_20260821 resolves both. This is not the first one either: CVE-2026-2670 hit the same device's OpenVPN handler earlier in the year via an identical pattern.

Credit where due — the vendor patched, and the fix predates public disclosure by two weeks. That is the coordination working. The failure mode is downstream.

Why an unmanaged gateway matters for your business

The WISE-6610 is a LoRaWAN-to-Ethernet gateway: it terminates long-range sensor traffic and speaks Modbus/TCP, MQTT, BACnet, and OPC UA on the other side. In practice it is the box in a warehouse, a cold-storage room, a building management closet, or a farm shed that turns a hundred cheap sensors into data your systems can read. It also holds VPN configuration and network server credentials.

The exposure is structural, not technical:

It was bought as equipment, not software. Sensor gateways get purchased on a project — an energy monitoring rollout, a refrigeration compliance job — and they get commissioned by the integrator who sold the sensors. Then the project closes. There is no license renewal, no vendor email, no update prompt. The firmware ships with the date it was flashed and stays there.

It sits on the operational side of the network. Which usually means it can reach the PLCs, the BMS, and the flat VLAN nobody segmented, and it is often the one OT device with a route out for remote support.

Nobody owns it. Ask a 40-person company who patches the LoRa gateway and you will get a look. That is the real vulnerability, and it is the one you can fix permanently.

The action today is boring and specific: find whether you have one. Check for WISE-6610 units in your asset list, in the integrator's commissioning docs, and on your network by looking for the management web interface. If the firmware string reads 1.2.1_20251110, flash 1.2.4_20260821 from Advantech and put the device on an inventory with a human name next to it. Then get its management interface off any network segment that touches the internet — the same discipline we argued for after the ZBT LTE router implants and the Dysphoria IoT botnet.

Sources: CVE-2026-79697 record, VulDB CVE-2026-79698, Advantech WISE-6610 product page.