Advantech ADAM-3600 EdgeLink: Packet forgery leading to command execution

Summary

A vulnerability in Advantech ADAM-3600 EdgeLink remote terminal unit firmware before version 2.8.5.0 allows an attacker to forge a network packet and execute arbitrary commands with maximum privileges. The CVSS vector indicates a network-based attack with low complexity, no privileges and no user interaction required, and high impact on confidentiality, integrity and availability. The affected device is used for industrial remote monitoring and control, so the risk depends on whether such devices are reachable from untrusted networks.

Affected

• Advantech ADAM-3600 EdgeLink, all versions prior to 2.8.5.0
• Default configuration: unaffected (according to the CVE record)

Fixed in

• Update to EdgeLink version 2.8.5.0 or later (vendor fix)
• The vendor advisory ACIRT-261001 covers this CVE; the exact code change for this CVE is not confirmed in the sources reviewed

Workaround

• Unknown. No vendor-published workaround was found for this CVE.
• Interim measures (analyst recommendation, not vendor-sourced): remove internet exposure, restrict device protocol ports to known management or SCADA hosts, and monitor for unexpected traffic to the device.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total
• Not listed in the CISA KEV catalogue
• No public proof of concept or exploit code was found in the sources reviewed; this does not prove none exists

Our recommendation

• Check whether any ADAM-3600 devices are in use and record their firmware version.
• If the version is below 2.8.5.0, schedule the update from the Advantech download page after a backup and a maintenance window.
• Verify that no ADAM-3600 device is reachable from the internet, partner networks or flat LANs.
• Review logs for unexpected traffic to the device and monitor it until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CSA Singapore Alert AL-2026-149 www.csa.gov.sg
• Advantech Security Advisories www.advantech.com
• Advantech ADAM-3600 Security Advisory PDF advcloudfiles.advantech.com
• OpenCVE CVE-2026-43836 app.opencve.io
• VulDB 422703 vuldb.com
• Securityonline ADAM-3600 vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:07.