Answer in brief
CVE-2026-19188 records a Unknown severity vulnerability in Haiwell IoT Cloud HMI Gateway OS Command Injection. The current sources do not mark it as known exploited. The current feed maps Haiwell/Haiwell IoT Cloud HMI Gateway (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Haiwell/Haiwell IoT Cloud HMI Gateway (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Haiwell/Haiwell IoT Cloud HMI Gatewaygeneric | 3.40.1.12 | Not reported |
Published upstream
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-19188 records a Unknown severity vulnerability in Haiwell IoT Cloud HMI Gateway OS Command Injection. The current sources do not mark it as known exploited. The current feed maps Haiwell/Haiwell IoT Cloud HMI Gateway (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Haiwell/Haiwell IoT Cloud HMI Gateway (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Haiwell/Haiwell IoT Cloud HMI Gatewaygeneric | 3.40.1.12 | Not reported |
Published upstream
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.
Quoted source text, attributed separately from HOL analysis.