Advantech ADAM-3600 EdgeLink: Denial of service via assertion fault

Summary

A flaw in Advantech ADAM-3600 EdgeLink remote terminal units allows an attacker to send a crafted message that triggers an assertion fault and crashes the service. The vulnerability is rated high (CVSS 8.2) and affects the availability of the device only; no code execution or data disclosure is described for this CVE. Per the research notes, the attack may need only network access and no privileges, but the CSA text does not confirm this. The same advisory lists 30 CVEs, several of them critical, so the whole batch should be addressed.

Affected

• Advantech ADAM-3600 EdgeLink prior to version 2.8.5.0
• Default configuration: unaffected (per CVE record)

Fixed in

• Update to version 2.8.5.0 or later (Advantech security update)
• Unknown whether the build status of 2.8.5.0 is final; verify on the vendor download page before rollout

Workaround

• No vendor workaround identified.
• Unverified monitoring step: watch device logs for assertion fault events and restart the device if it crashes.
• Restrict network access to the device and its service ports to trusted hosts; do not expose it to the internet.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC data: exploitation none, automatable no, technical impact partial.
• No public proof of concept or exploit code found in the research; this is not proof that none exists.

Our recommendation

• Update all ADAM-3600 EdgeLink units to 2.8.5.0 in one planned maintenance window, not only for this CVE.
• Check whether any device is reachable from the internet and remove such exposure.
• Restrict access to the device to trusted management networks.
• Monitor devices for unexpected crashes or restarts.
• Prioritise the critical CVEs in the same advisory, such as CVE-2026-43844 (authentication bypass, 9.3) and CVE-2026-43850 (root-level command injection, 8.6).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CSA alert AL-2026-149 www.csa.gov.sg
• Advantech security advisory page www.advantech.com
• Advantech ADAM-3600 advisory PDF advcloudfiles.advantech.com
• VulDB CVE-2026-43853 vuldb.com
• OpenCVE CVE-2026-43853 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:36.