{"id":"CVE-2026-43835","kind":"vulnerability","aliases":["CVE-2026-43835"],"related":[],"title":"Firmware upgrade accepts forged images, letting an authenticated user persist on device","description":"A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.","summary":"Advantech ADAM-3600 EdgeLink RTU firmware before 2.8.5.0 does not properly verify firmware upgrade files. An authenticated admin-level user can upload a forged image and persistently take over the device. Part of a batch of 30 fixes released together.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","edgelink","firmware","ics","infrastructure","network-appliance","rtu"],"not_affected_if":["firmware-2.8.5.0-or-later","no-authenticated-access","unauthenticated-only-access"],"how_to_check":"Open the ADAM-3600 web UI or EdgeLink system info and read the firmware version. Anything below 2.8.5.0 is affected. Also check whether the web or management interface is reachable from untrusted networks.","fix":"Upgrade ADAM-3600 EdgeLink firmware to 2.8.5.0 or later (download from the Advantech ADAM-3600 firmware support page). Until then, restrict network access to the device, use strong unique admin credentials, and only install firmware obtained directly from Advantech.","status":"open","published_at":"2026-10-20T08:16:44+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:43+00:00","updated_at":"2026-10-24T00:17:20+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:39:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Firmware upgrade accepts forged images, letting an authenticated user persist on device","impact":"high","summary":"A flaw in the device's firmware upgrade function lets a logged-in attacker upload a forged firmware file. The attacker can then compromise the device permanently.","category":"infrastructure","who_cares":["network-appliance","firmware"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker gains permanent control of the device through a forged firmware image.","analyst_note":"Identify the affected vendor and product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43835 and find the vendor advisory for affected versions and the fixed firmware.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unauthenticated-only-access"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000457,"input_tokens":2865,"output_tokens":341,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected vendor and product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43835 and find the vendor advisory for affected versions and the fixed firmware.","search":"'-2026':14A,17A '-3600':20A,23B,35B '-43835':15A,18A '2.8.5.0':40B '30':70B 'accept':3A 'adam':19A,22B,34B 'admin':51B 'admin-level':50B 'advantech':24B,33B 'allow':82C 'applianc':31B 'attack':85C 'authent':8A,49B,84C 'batch':68B 'compromis':94C 'could':81C 'cve':13A,16A 'devic':12A,64B,96C 'edgelink':21A,25B,36B 'file':47B,92C 'firmwar':1A,26B,38B,45B,78C,90C 'fix':71B 'forg':4A,57B,89C 'function':80C 'ic':27B 'imag':5A,58B 'infrastructur':28B 'let':6A 'level':52B 'network':30B 'network-appli':29B 'part':65B 'perman':97C 'persist':10A,60B 'potenti':93C 'proper':43B 'releas':72B 'rtu':32B,37B 'take':61B 'togeth':73B 'upgrad':2A,46B,79C,91C 'upload':55B,87C 'user':9A,53B 'verifi':44B 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T08:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43835","severity":null,"published_at":"2026-10-20T08:16:44+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43835:626","url":null,"severity":null,"published_at":"2026-10-24T00:17:20+00:00","modified_at":"2026-10-24T00:17:20+00:00","first_seen_at":"2026-10-24T00:17:20+00:00","fetched_at":"2026-10-24T00:17:20+00:00","note":"Advantech ADAM-3600 EdgeLink, advisory ACIRT-261001 (PDF item 7, NN-2025-0126), one of 30 CVEs (43829-43858) fixed in v2.8.5.0; CWE-345. Vendor fix is asymmetric digital signature verification of firmware. No exploitation or PoC reported (CISA SSVC exploitation none). Found by Nozomi Networks. Did not search social: ICS device, no CVE-specific conversation expected. Fixed-version page for 2.8.5.0 download not read; 2.8.5.1 is mentioned in the PDF for a different CVE."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1922,"url":"https://www.cyber.gc.ca/en/alerts-advisories/control-systems-advantech-security-advisory-av26-1065","title":"Canadian Cyber Centre AV26-1065: Advantech ADAM-3600 prior to v2.8.5.0","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}