CyberRota Analysis
AI-GeneratedA critical OS command injection vulnerability exists in the Net Check feature of the Haiwell IoT Cloud HMI Gateway, specifically through the /setting endpoint. This flaw allows attackers to inject and execute arbitrary OS commands with root privileges, potentially compromising the entire system. Organizations using this product should prioritize immediate remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.