{"id":"CVE-2026-43837","kind":"vulnerability","aliases":["CVE-2026-43837"],"related":[],"title":"Password verification buffer overflow lets guest-authenticated attacker run code","description":"A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.","summary":"Buffer overflow in the password verification function of Advantech ADAM-3600 EdgeLink (industrial remote terminal unit) firmware before 2.8.5.0. An attacker with a guest login can reach it over the network and achieve code execution. Part of a batch of 30 ADAM-3600 CVEs fixed together. No exploitation reported.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","edgelink","firmware","ics","other","rtu"],"not_affected_if":["firmware-2.8.5.0-or-later","no-guest-account","not-network-reachable"],"how_to_check":"Check the EdgeLink firmware version on each ADAM-3600 (device web UI / system info). Anything below 2.8.5.0 is affected. Also check whether guest accounts are enabled and whether the device is reachable from untrusted networks.","fix":"Update ADAM-3600 EdgeLink firmware to 2.8.5.0 or later (Advantech released 2026-10-15; some Advantech text refers to 2.8.5.1, so prefer the newest build from the Advantech ACIRT-261001 advisory). Until then: disable guest accounts, keep RTUs off the internet, and firewall them.","status":"open","published_at":"2026-10-20T09:17:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:22:47+00:00","updated_at":"2026-10-25T03:37:19+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:22:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Password verification buffer overflow lets guest-authenticated attacker run code","impact":"high","summary":"A buffer overflow in the password verification functionality of an unnamed product can be triggered by an attacker holding guest credentials. Successful exploitation lets the attacker execute code on the affected system.","category":"other","nicknames":[],"who_cares":[],"confidence":0.4,"needs_auth":"yes","worst_case":"Attacker with guest login runs code on the affected system","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43837; the sources give no product name, version or vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000492,"input_tokens":3251,"output_tokens":333,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43837; the sources give no product name, version or vendor advisory.","search":"'-2026':13A,16A '-3600':19A,22B,39B,71B '-43837':14A,17A '2.8.5.0':47B '30':69B 'achiev':61B,95C 'adam':18A,21B,38B,70B 'advantech':23B,37B 'allow':88C 'attack':9A,49B,90C 'authent':8A,93C 'batch':67B 'buffer':3A,29B,79C 'code':11A,62B,96C 'could':87C 'cve':12A,15A 'cves':72B 'edgelink':20A,24B,40B 'execut':63B,97C 'exploit':76B 'firmwar':25B,45B 'fix':73B 'function':35B,86C 'guest':7A,52B,92C 'guest-authent':6A 'ic':26B 'industri':41B 'let':5A 'login':53B 'network':59B 'overflow':4A,30B,80C 'part':64B 'password':1A,33B,84C 'reach':55B 'remot':42B 'report':77B 'rtu':28B 'run':10A 'termin':43B 'togeth':74B 'unit':44B 'verif':2A,34B,85C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43837","severity":null,"published_at":"2026-10-20T09:17:10+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43837:754","url":null,"severity":null,"published_at":"2026-10-25T03:37:19+00:00","modified_at":"2026-10-25T03:37:19+00:00","first_seen_at":"2026-10-25T03:37:19+00:00","fetched_at":"2026-10-25T03:37:19+00:00","note":"Product identified via NVD API: Advantech ADAM-3600 EdgeLink RTU, affected < 2.8.5.0 (NVD, CSA SG, Canada Cyber Centre); Advantech advisory ACIRT-261001 item 9 (NN-2025-0133) confirms the bug and says fix is bounds validation. Part of a 30-CVE batch (43829-43858). Version caveat: Advantech PDF and a third-party page mention 2.8.5.1 for other items, so confirm the exact fixed build with Advantech. No exploitation or PoC found; not verified any field (fixed version only seen on NVD/CSA/CCCS, not stated in vendor text I read)."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1922,"url":"https://www.cyber.gc.ca/en/alerts-advisories/control-systems-advantech-security-advisory-av26-1065","title":"Canadian Cyber Centre AV26-1065: Advantech ADAM-3600 prior to v2.8.5.0","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}