Advantech ADAM-3600 EdgeLink: Arbitrary file write
Summary
Advantech ADAM-3600 EdgeLink remote terminal unit firmware prior to version 2.8.5.0 contains a vulnerability that allows an authenticated attacker to write files to arbitrary locations on the system. The attacker needs valid credentials with high privileges, but the flaw is reachable over the network (CVSS 4.0 8.2, CWE-22). Successful exploitation can impair the integrity of the device. No exploitation has been reported, and the flaw is one of 30 CVEs fixed in the same firmware batch.
Affected
- Advantech ADAM-3600 EdgeLink, all firmware versions prior to 2.8.5.0
- Default configuration: unaffected (per CVE record)
Fixed in
- Firmware EdgeLink v2.8.5.0 (per vendor advisory ACIRT-261001)
- Unverified: a 2.8.5.1 release is mentioned by a third party but not confirmed by Advantech; whether 2.8.5.0 is a production (non-Beta) release is unknown
Workaround
- No vendor-published workaround specific to this CVE is known.
- Unverified third-party note: the fix restricts read and write directories. Check this against the vendor advisory.
- Until patched: keep the management interface off the internet, restrict access to trusted engineering networks, limit and audit accounts with credentials, and monitor configuration and file integrity.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- No public proof of concept or exploitation reports found at the time of research.
- Not listed in the CISA KEV catalogue (per research notes).
Our recommendation
- Confirm with Advantech which firmware build is the production release for your model before rollout.
- Update affected devices to firmware 2.8.5.0 or later; one update covers the whole CVE-2026-43829 to CVE-2026-43858 batch.
- Check whether any ADAM-3600 device is reachable from the internet and remove such exposure.
- Restrict and audit credentials for the device and monitor for unexpected file changes.
- Relevance for an SME is low to moderate: this is an industrial RTU mainly used in utilities and remote sites. Prioritise only if you operate such telemetry.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Advantech security advisories www.advantech.com
- CSA Singapore alert AL-2026-149 www.csa.gov.sg
- Advantech security advisory PDF for ADAM-3600 advcloudfiles.advantech.com
- OpenCVE CVE-2026-43852 (SSVC data) app.opencve.io
- VulDB CVE-2026-43852 vuldb.com
- CVE threat tracker CVE-2026-43852 cve.threatint.com
- Third-party analysis of the ADAM-3600 CVE batch safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:36.
Original description (NVD)
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.