Advantech ADAM-3600 EdgeLink: Forged firmware upload allows permanent device compromise
Summary
The firmware upgrade function of the Advantech ADAM-3600 EdgeLink remote terminal unit does not sufficiently verify forged firmware upgrade files in versions before 2.8.5.0. An authenticated attacker can upload a manipulated firmware file, which can permanently compromise the device. The attack is possible over the network with low complexity, but requires authenticated access with high privileges according to CVSS.
Affected
- Advantech ADAM-3600 EdgeLink, versions prior to 2.8.5.0
- Default configuration: unaffected (according to the CVE record)
Fixed in
- EdgeLink v2.8.5.0 (according to Advantech advisory ACIRT-261001)
Workaround
- No interim workaround specified by the vendor. The vendor fix uses digital signatures for the firmware update path.
- General hardening until the update: restrict access to the management interface to trusted admin hosts or a VPN, and rotate admin credentials.
Exploitation
- No evidence of exploitation in the wild; not listed in the CISA KEV catalogue.
- CISA SSVC: exploitation none, not automatable.
- No public proof of concept known (VulDB: no exploit available).
Our recommendation
- Upgrade to EdgeLink v2.8.5.0 promptly. The same advisory lists several critical vulnerabilities for this device.
- Before rollout, confirm on Advantech's download page that the 2.8.5.0 image is a production release and not a beta build (unconfirmed third-party report), and verify the image hash against Advantech's published values.
- Confirm that the device is not reachable from the internet, and restrict management access.
- Check whether other ADAM-3600 units in your environment run affected firmware.
- Monitor logs for unexpected firmware uploads or device reboots.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Advantech Security Advisories www.advantech.com
- CSA Singapore AL-2026-149 www.csa.gov.sg
- Advantech ADAM-3600 advisory PDF advcloudfiles.advantech.com
- Canadian Cyber Centre AV26-1065 www.cyber.gc.ca
- VulDB CVE-2026-43835 vuldb.com
- OpenCVE CVE-2026-43835 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:43.
Original description (NVD)
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.