Advantech ADAM-3600 EdgeLink: Command injection allows root code execution

Summary

Advantech ADAM-3600 EdgeLink, a remote terminal unit for industrial data acquisition and remote monitoring, contains a command injection vulnerability (CWE-77). An authenticated attacker can inject commands and gain root-level code execution on the device. The attacker needs valid credentials, which the CVSS vector reflects with high privileges required (PR:H), so exposed management interfaces and weak or shared passwords are the main risk.

Affected

• Advantech ADAM-3600 EdgeLink prior to version 2.8.5.0
• Default configuration: unaffected (according to the CVE record)

Fixed in

• Update to version 2.8.5.0 or later (vendor security update, advisory ACIRT-261001)
• Confirm the exact firmware file and release notes on the Advantech advisory before deployment

Workaround

• Per the Advantech advisory PDF, disable the script execution capability of AdvProgramMgr as an interim mitigation (verify the exact wording in the PDF)
• This is a stopgap only; the firmware update is the fix

Exploitation

• No public proof of concept known
• No reports of exploitation in the wild known
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• Not listed in the CISA KEV catalogue
• Absence of known exploitation is not confirmed absence

Our recommendation

• Inventory all ADAM-3600 EdgeLink units and record their firmware versions
• Plan the update to 2.8.5.0 or later, covering the whole ACIRT-261001 advisory, not only this CVE
• Remove internet exposure of the management interface and restrict access to trusted hosts
• Review and rotate shared or weak credentials on these devices
• Apply the interim mitigation if patching must be delayed
• Prioritise units reachable from the internet or from flat networks

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CSA Singapore Alert AL-2026-149 www.csa.gov.sg
• Advantech Security Advisories www.advantech.com
• Advantech ADAM-3600 Security Advisory PDF advcloudfiles.advantech.com
• OpenCVE CVE-2026-43850 app.opencve.io
• VulDB CVE-2026-43850 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:42.