CISA published a run of industrial control system advisories on August 13, and the worst of them carries the maximum possible severity score. A command injection flaw in Haiwell's IoT Cloud HMI Gateway, tracked as CVE-2026-19188, is rated 10 out of 10 on both the CVSS 3.1 and CVSS 4.0 scales, and lets an attacker who can reach the device over the network run operating system commands on it as root, with no credentials required.
The gateway connects Haiwell operator panels and controllers to the vendor's cloud service. CISA lists it as deployed worldwide across the energy, critical manufacturing, and water and wastewater sectors, and puts the vendor's headquarters in China. According to the advisory, the flaw sits in the Net Check feature reached through the /setting endpoint, where the cmdPing Socket.io event hands user supplied input to the operating system without sanitizing it first. Version 3.40.1.12 is affected. Haiwell has fixed it in Scada-v3.50.1.19, available from the vendor's download page, and researcher Fiqram Akmal reported the issue to CISA.
CISA has not said the flaw is being exploited. Reaching it still requires network access to the gateway, which is the whole point of the agency's standing advice for this class of kit: keep control system devices off the public internet, put them behind firewalls, and separate them from the business network. Exposed operator interfaces keep turning up in its casework, from water utilities locked out of internet facing PLCs to fuel terminal controllers shipping with an open root debug port.
What else CISA flagged
Ten more advisories went out the same day, most of them for Siemens products, which Siemens ProductCERT reported to CISA itself. Ordered by severity:
- Siemens Siveillance Video, CVSS 9.1. CVE-2026-3014 could allow remote code execution against the video management servers. Siemens has released fixed versions, starting at 23.3.27 for V2023 R3.
- ANDRITZ HIPASE-250 and 250 SCALA, CVSS 8.1. Four flaws in versions up to 7.20 of these energy sector protection and control devices, which CISA says could let an attacker read data from the device or gain access to affected workstations.
- Johnson Controls Metasys, CVSS 8.0. CVE-2026-34491 lets a low privilege user plant a persistent malicious payload via a crafted URL, which then runs inside other users' sessions, administrators included, opening the way to session hijacking in this building management platform.
- Siemens License Server, CVSS 7.5. An insecure sudoers policy allows local privilege escalation and lets an attacker plant files as root (CVE-2026-69108, scored 6.0), while a path traversal flaw lets a remote attacker read arbitrary files (CVE-2026-69109, scored 7.5). The fixes are V5.1 and V5.3 respectively.
- Siemens engineering software, CVSS 7.8. Parasolid, Simcenter Femap and Solid Edge all parse untrusted files unsafely, so a user who opens a malicious X_T, BMP, PAR, PSM or DFT file can crash the application or, potentially, run attacker code. Updates exist for all three.
- Johnson Controls Airwall, CVSS 6.8. CVE-2026-64887 is a hardcoded cryptographic key that, in CISA's words, is identical across all installations of the product and across all customer organizations, so a single disclosure of it would let anyone holding it decrypt sensitive data in configuration and database files. Versions up to 4.0.4 are affected and Johnson Controls recommends applying 4.1.0 or later.
- Siemens LOGO! Soft Comfort, CVSS 6.8. The software encrypts project files with a static, hardcoded AES master key (CVE-2026-57262) and stores project passwords as unsalted SHA-256 hashes (CVE-2026-57263), so a local attacker holding a project file can strip its password or crack it offline. Fixed in V9, but Siemens notes a hardware upgrade to a LOGO! V9 BM module or later is also needed, otherwise the software runs in a compatibility mode where the flaws remain.
- Siemens Desigo DXR and PXC controllers, CVSS 4.3. Malformed BACnet packets can knock these building controllers offline, and recovery takes a device reset or reboot (CVE-2026-59693).
What you should do
Haiwell's gateway is the one to move on first: it needs no credentials, it hands over root, and it sits in front of physical process equipment. After that, the two hardcoded key issues deserve attention out of proportion to their middling scores, because a key shared across every installation is not something a firewall rule fixes and, in the LOGO! case, the update alone is not enough without the matching hardware. Every product named above has a fixed version available, so this is a patching exercise rather than a mitigation one. Where a patch window is weeks away, CISA's usual compensating controls apply: minimize network exposure, keep the devices off the internet, and put remote access behind a VPN that is itself kept current.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.