Cyber Resilience

CVE-2026-2670

HighRCE

Published: 18 February 2026

Published
18 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v4 7.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0004 12.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2670 is a high-severity Command Injection (CWE-77) vulnerability in Advantech WISE-6610 (inferred from references). Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2026-2670 is an OS command injection vulnerability (CWE-77, CWE-78) in Advantech WISE-6610 version 1.2.1_20251110. It affects an unknown function within the file /cgi-bin/luci/admin/openvpn_apply of the Background Management component, where manipulation of the delete_file argument enables command injection.

The vulnerability is remotely exploitable over the network with low attack complexity but requires high privileges (PR:H) and no user interaction, carrying a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Attackers with sufficient access can achieve high impacts on confidentiality, integrity, and availability, and a public exploit is available for potential use.

Advisories from VulDB and a GitHub issue indicate that Advantech was contacted early regarding disclosure but provided no response. No patches or mitigations are detailed in the references.

EU & UK References

Vulnerability details

A vulnerability was identified in Advantech WISE-6610 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The…

more

exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)
CWE-77CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection in the exposed Luci web management interface (/cgi-bin/luci/admin/openvpn_apply) directly enables remote exploitation of a public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-9454Shared CWE-77, CWE-78
CVE-2026-6116Shared CWE-77, CWE-78
CVE-2026-6158Shared CWE-77, CWE-78
CVE-2026-7138Shared CWE-77, CWE-78
CVE-2025-9387Shared CWE-77, CWE-78
CVE-2025-15472Shared CWE-77, CWE-78
CVE-2026-2260Shared CWE-77, CWE-78
CVE-2026-9385Shared CWE-77, CWE-78
CVE-2026-4465Shared CWE-77, CWE-78
CVE-2026-7125Shared CWE-77, CWE-78

Affected Assets

Advantech
WISE-6610
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of the delete_file argument in /cgi-bin/luci/admin/openvpn_apply to block OS command injection.

AC-6 Least Privilege partial match
prevent

Limits the high-privilege accounts that can reach the vulnerable openvpn_apply endpoint, reducing the attack surface.

AC-3 Access Enforcement partial match
prevent

Enforces access-control decisions on the Background Management component so only authorized subjects may invoke the delete_file function.

References