Advantech WISE-6610-NB Background Management openvpn_apply os command injection
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the component Background Management. Such manipulation of the argument delete_file leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to address this issue. It is advisable to upgrade the affected component. The vendor explains: "The delete operation has been redesigned to map the requested file type to a fixed allowlisted path, require a numeric tunnel ID, reject invalid requests, and use the native filesystem API (fs.unlink) instead of constructing a shell command from request data."
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
WISE-6610-NB
Vendor
Advantech
Product
WISE-6610-NB
Platforms
Unknown
Default status
Unknown
WISE-6610-NB · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.2.1_20251110
affected
Unavailable
Unavailable
Unavailable
None listed
1.2.4_20260821
unaffected
Unavailable
Unavailable
Unavailable
None listed
WISE-6610-EB
Vendor
Advantech
Product
WISE-6610-EB
Platforms
Unknown
Default status
Unknown
WISE-6610-EB · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.2.1_20251110
affected
Unavailable
Unavailable
Unavailable
None listed
1.2.4_20260821
unaffected
Unavailable
Unavailable
Unavailable
None listed
WISE-6610-TB
Vendor
Advantech
Product
WISE-6610-TB
Platforms
Unknown
Default status
Unknown
WISE-6610-TB · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.2.1_20251110
affected
Unavailable
Unavailable
Unavailable
None listed
1.2.4_20260821
unaffected
Unavailable
Unavailable
Unavailable
None listed
WISE-6610-JB
Vendor
Advantech
Product
WISE-6610-JB
Platforms
Unknown
Default status
Unknown
WISE-6610-JB · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.2.1_20251110
affected
Unavailable
Unavailable
Unavailable
None listed
1.2.4_20260821
unaffected
Unavailable
Unavailable
Unavailable
None listed
WISE-6610-CB
Vendor
Advantech
Product
WISE-6610-CB
Platforms
Unknown
Default status
Unknown
WISE-6610-CB · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.2.1_20251110
affected
Unavailable
Unavailable
Unavailable
None listed
1.2.4_20260821
unaffected
Unavailable
Unavailable
Unavailable
None listed
WISE-6610-EL-NB
Vendor
Advantech
Product
WISE-6610-EL-NB
Platforms
Unknown
Default status
Unknown
WISE-6610-EL-NB · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.2.1_20251110
affected
Unavailable
Unavailable
Unavailable
None listed
1.2.4_20260821
unaffected
Unavailable
Unavailable
Unavailable
None listed
WISE-6610-EL-EB
Vendor
Advantech
Product
WISE-6610-EL-EB
Platforms
Unknown
Default status
Unknown
WISE-6610-EL-EB · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.2.1_20251110
affected
Unavailable
Unavailable
Unavailable
None listed
1.2.4_20260821
unaffected
Unavailable
Unavailable
Unavailable
None listed
WISE-6610-EL-TB
Vendor
Advantech
Product
WISE-6610-EL-TB
Platforms
Unknown
Default status
Unknown
WISE-6610-EL-TB · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.2.1_20251110
affected
Unavailable
Unavailable
Unavailable
None listed
1.2.4_20260821
unaffected
Unavailable
Unavailable
Unavailable
None listed
WISE-6610-EL-JB
Vendor
Advantech
Product
WISE-6610-EL-JB
Platforms
Unknown
Default status
Unknown
WISE-6610-EL-JB · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.2.1_20251110
affected
Unavailable
Unavailable
Unavailable
None listed
1.2.4_20260821
unaffected
Unavailable
Unavailable
Unavailable
None listed
WISE-6610-EL-CB
Vendor
Advantech
Product
WISE-6610-EL-CB
Platforms
Unknown
Default status
Unknown
WISE-6610-EL-CB · Scoped product and version facts