{"id":"CVE-2026-43836","kind":"vulnerability","aliases":["CVE-2026-43836"],"related":[],"title":"Forged network packet can run arbitrary commands with maximum privileges","description":"A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.","summary":"Advantech ADAM-3600 EdgeLink (industrial remote terminal unit) has an unauthenticated network flaw. A forged packet makes the device run arbitrary commands with maximum privileges (CVSS 4.0 9.3). It is one of 30 flaws (CVE-2026-43829 to 43858) fixed in EdgeLink 2.8.5.0. The vendor's fix adds content-length and IP-address format validation and replaces the system() call with fork plus execv, which points to command injection. No exploitation reported.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","edgelink","ics","network","ot","other","rce","rtu","unauthenticated","unknown"],"not_affected_if":["firmware-2.8.5.0-or-later","not-internet-exposed"],"how_to_check":"Check the EdgeLink firmware version on each ADAM-3600 in its web UI or Advantech's device tooling. Anything below 2.8.5.0 is affected. Also check whether the device's proprietary-protocol and web ports are reachable from untrusted networks or the internet.","fix":"Update ADAM-3600 EdgeLink to 2.8.5.0 or later (the vendor says to do this as soon as possible). Until then, keep the device off the internet, put it behind a firewall, and limit access to the proprietary protocol and web interface to trusted hosts. Confirm the exact fixed build on Advantech's firmware page.","status":"open","published_at":"2026-10-20T09:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:39+00:00","updated_at":"2026-10-23T23:23:34+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:39:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Forged network packet can run arbitrary commands with maximum privileges","impact":"high","summary":"A flaw lets an attacker send a forged packet that makes the target execute arbitrary commands with the highest privileges. The sources give no product name, affected versions or patch details.","category":"other","who_cares":["unknown"],"confidence":0.3,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands as the highest privilege on the device","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43836 and find the vendor advisory and patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000441,"input_tokens":2851,"output_tokens":311,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43836 and find the vendor advisory and patch.","search":"'-2026':12A,15A,67B '-3600':18A,21B,34B '-43829':68B '-43836':13A,16A '2.8.5.0':74B '30':64B '4.0':58B '43858':70B '9.3':59B 'adam':17A,20B,33B 'add':79B 'address':86B 'advantech':22B,32B 'allow':109C 'arbitrari':6A,52B,118C 'attack':111C 'call':93B 'command':7A,53B,101B,119C 'content':81B 'content-length':80B 'could':108C 'cve':11A,14A,66B 'cvss':57B 'devic':50B 'edgelink':19A,23B,35B,73B 'execut':117C 'execv':97B 'exploit':104B 'fix':71B,78B 'flaw':44B,65B 'forg':1A,46B,113C 'fork':95B 'format':87B 'ic':24B 'industri':36B 'inject':102B 'ip':85B 'ip-address':84B 'length':82B 'make':48B 'maximum':9A,55B,121C 'network':2A,25B,43B 'one':62B 'ot':26B 'packet':3A,47B,115C 'plus':96B 'point':99B 'privileg':10A,56B,122C 'rce':28B 'remot':37B 'replac':90B 'report':105B 'rtu':29B 'run':5A,51B 'system':92B 'termin':38B 'unauthent':30B,42B 'unit':39B 'unknown':31B 'valid':88B 'vendor':76B 'vulner':107C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43836","severity":null,"published_at":"2026-10-20T09:17:09+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43836:429","url":null,"severity":null,"published_at":"2026-10-23T23:23:34+00:00","modified_at":"2026-10-23T23:23:34+00:00","first_seen_at":"2026-10-23T23:23:34+00:00","fetched_at":"2026-10-23T23:23:34+00:00","note":"Identified as Advantech ADAM-3600 EdgeLink (ACIRT-261001, item 8, NN-2025-0132; found by Nozomi Networks). Affected: all versions before 2.8.5.0 per CVE record and Canadian Cyber Centre. Vendor says fixed 2026-10-15. No exploitation or public PoC found (not in KEV, EPSS under 1%). Not checked: X/Bluesky chatter, since no CVE-specific posts surfaced in search. Open question: the Advantech download page lists 2.8.5.0 as Beta and the PDF mentions 2.8.5.1 for other items, so confirm the exact fixed build with Advantech."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1930,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149/","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1932,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43836","title":"CVE Record CVE-2026-43836 (affected: prior to 2.8.5.0; credit Nozomi Networks)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1922,"url":"https://www.cyber.gc.ca/en/alerts-advisories/control-systems-advantech-security-advisory-av26-1065","title":"Canadian Cyber Centre AV26-1065: Advantech ADAM-3600 prior to v2.8.5.0","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1935,"url":"https://www.advantech.com/en-us/support/details/firmware?id=1-1R5NNRV","title":"ADAM-3600-C2G EdgeLink Image downloads (2.8.5.0 listed as Beta)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}