CVE-2026-79697 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-79697 requires immediate attention.

· 8 min read

Executive Summary

CVE-2026-79697 is a critical remote command injection flaw in multiple Advantech WISE-6610 device variants, with a CVSS 9.9 score. The issue affects the basicstation_apply function in the Basic Station Certificate-Deletion Handler, where manipulation of the act argument can lead to command execution. Although KEV = No and there is no confirmed wild exploitation, the exploit has been publicly disclosed, which makes this an urgent patching event for any team exposing these devices or managing them remotely.

Advantech has already released a fix: upgrade to 1.2.4_20260821 or later. If you run any affected WISE-6610 model on 1.2.1_20251110, treat this as an immediate priority.

Immediate Action

  • Patch now: upgrade affected devices to 1.2.4_20260821 or later as soon as possible.
  • Reduce exposure: remove internet-facing access, VPN portals, and any direct management access until patched.
  • Isolate management traffic: place device admin interfaces behind a trusted management VLAN or jump host.
  • Check for abuse: review logs for unusual certificate-deletion actions, unexpected shell activity, or repeated requests to the Basic Station handler.
  • Back up config first: export device settings before upgrading so you can roll back safely if needed.
  • Vendor reference: see the Advantech security advisory and firmware release notes.

Affected Versions

  • Advantech WISE-6610-NB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610-EB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610-TB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610-JB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610-CB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610-EL-NB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610-EL-EB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610-EL-TB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610-EL-JB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610-EL-CB@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610P-DEA@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610P-DNA@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+
  • Advantech WISE-6610P-DTA@1.2.1_20251110 vulnerable; upgrade to 1.2.4_20260821+

Resolution Guide

Primary fix: install the vendor firmware update. For embedded appliances, package-manager commands below are not usually applicable; use them only if your environment wraps the device software in a managed image or test harness.

# Firmware/Appliance upgrade (preferred)
# TODO: download the fixed firmware from the vendor advisory page
# TODO: verify checksum/signature before flashing
# TODO: schedule maintenance window and back up config first
# Docker image tag example (if you mirror the appliance stack in containers)
docker pull advantech/wise-6610:1.2.4_20260821
docker tag advantech/wise-6610:1.2.4_20260821 wise-6610:patched
# JavaScript dependency pinning example (only if this component is embedded in a JS wrapper)
npm i basicstation-handler@1.2.4_20260821
yarn add basicstation-handler@1.2.4_20260821
pnpm add basicstation-handler@1.2.4_20260821
# Python packaging example (only if a Python integration layer exists)
pip install --upgrade basicstation-handler==1.2.4_20260821
pipx upgrade basicstation-handler
# Java build example (only if packaged as a library)
mvn versions:use-dep-version -Dincludes=com.advantech:basicstation-handler -DdepVersion=1.2.4_20260821
./gradlew dependencies
# Linux package workflow example
apt-get update
apt-get install --only-upgrade wise-6610-firmware
yum update wise-6610-firmware

Hardening while you patch:

# Disable or restrict the vulnerable management surface if your model supports it
# TODO: turn off Basic Station certificate deletion / admin endpoint
# TODO: bind admin UI to localhost or management VLAN only
# TODO: require VPN or jump host for all device administration

Minimal code-level mitigation example if you maintain a wrapper or automation layer that passes the act argument:

// Reject unexpected values before calling the handler
const allowed = new Set(["delete", "list", "status"]);
if (!allowed.has(req.body.act)) {
  return res.status(400).send("Invalid action");
}
// Never pass raw user input into shell commands

Detection & Verification

Check versions: confirm whether any device reports 1.2.1_20251110 or earlier in the affected family.

# Example inventory check
# TODO: replace with your device inventory command or management API query
curl -k https://DEVICE-IP/api/version
ssh admin@DEVICE-IP 'cat /etc/version'

Search for exposure: look for requests or logs referencing the Basic Station Certificate-Deletion Handler or suspicious act values.

# Grep local logs if exported
grep -RniE "basicstation_apply|Certificate-Deletion|act=" /var/log /opt/logs

Use dependency or asset auditors: if you track firmware in CMDB, query for the exact model and firmware string.

# Example CMDB or asset query
# TODO: replace with your inventory tool
assetctl find --model "WISE-6610*" --firmware "1.2.1_20251110"

Verify the fix: after upgrading, confirm the device reports 1.2.4_20260821 or later and that the vulnerable endpoint no longer accepts unsafe input.

# Post-upgrade verification
curl -k https://DEVICE-IP/api/version | grep -E "1\.2\.4_20260821|later"
# Re-test the management path with a harmless request and confirm it rejects malformed act values

Risk and Impact

This flaw can let a remote attacker run commands on the device by abusing the certificate-deletion handler, which may lead to full device compromise. For solo developers and small teams, the main blast radius is often bigger than the device itself: network pivoting, credential theft, and disruption of any service that depends on the gateway. If these devices sit on a production or OT network, assume the impact can extend to connected systems and treat exposure as urgent.

Keep reading