Advantech ADAM-3600 EdgeLink: Arbitrary code execution in service
Summary
Advantech ADAM-3600 EdgeLink remote terminal units prior to version 2.8.5.0 contain a code injection flaw (CWE-94). A remote attacker with authenticated, high-privileged access can execute arbitrary code with the privileges of the service. The vendor and the CNA rate the issue at CVSS 8.6 (High), and the CVSS vector shows high impact on confidentiality, integrity and availability.
Affected
- Advantech ADAM-3600 EdgeLink prior to version 2.8.5.0
- Default configuration: unaffected (per CVE record)
Fixed in
- Version 2.8.5.0 or later (first version outside the stated affected range; the vendor's explicit fixed-version statement for this CVE is unverified)
Workaround
Unknown. No vendor mitigation text was found for this CVE.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact
- Not listed in the CISA KEV catalogue
- No public proof of concept or in-the-wild exploitation found
Our recommendation
- Identify all ADAM-3600 EdgeLink units and confirm the firmware is 2.8.5.0 or later
- Restrict access to the management interface to the OT network and keep it off the internet
- Limit and review administrator accounts, since the attack requires high privileges
- Patch the other ADAM-3600 CVEs from the same advisory in the same cycle; CSA rates some of them higher
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CSA Singapore alert AL-2026-149 www.csa.gov.sg
- Advantech Security Advisories www.advantech.com
- OpenCVE CVE-2026-43857 app.opencve.io
- VulDB 422737 vuldb.com
- OffSeq Radar CVE-2026-43857 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:40.
Original description (NVD)
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.