{"id":"CVE-2026-43838","kind":"vulnerability","aliases":["CVE-2026-43838"],"related":[],"title":"Unnamed login component: stack overflow lets attacker run code","description":"A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.","summary":"Stack-based buffer overflow in the login functionality of Advantech ADAM-3600 EdgeLink remote terminal units (industrial data acquisition). Network-reachable, no auth or user interaction needed (CVSS 4.0 9.2, AC:H). Part of Advantech advisory ACIRT-261001 covering about 30 ADAM-3600 CVEs, disclosed 2026-10-20. Found by Nozomi Networks. No known exploitation.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":["2.8.5.1"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","buffer-overflow","edgelink","ics","ot","other","rtu","unknown-product"],"not_affected_if":["firmware-2.8.5.1-or-later","not-exposed-to-network"],"how_to_check":"Check the ADAM-3600 EdgeLink firmware/software version in the device web UI or EdgeLink Studio. Anything below 2.8.5.0 is affected per the CVE record. Check whether the device's web/login service is reachable from untrusted networks.","fix":"Update ADAM-3600 EdgeLink to the latest Advantech release (2.8.5.1 or later; the CVE record says fixed in 2.8.5.0, a sibling CVE says 2.8.5.1). If you cannot patch, remove internet and untrusted-network exposure and restrict access to the device by firewall or VPN. Advisory ACIRT-261001 on advantech.com.","status":"open","published_at":"2026-10-20T09:17:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:38+00:00","updated_at":"2026-10-23T23:22:23+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Unnamed login component: stack overflow lets attacker run code","impact":"high","summary":"A stack-based buffer overflow in a login function can be triggered to corrupt memory. An attacker who reaches that login path can achieve code execution.","category":"other","who_cares":["unknown-product"],"confidence":0.4,"needs_auth":"unknown","worst_case":"attacker runs code with the privileges of the vulnerable service","analyst_note":"Sources name no product, vendor or version; check NVD CVE-2026-43838 entry for affected product, then confirm login reachability and patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000428,"input_tokens":2847,"output_tokens":287,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources name no product, vendor or version; check NVD CVE-2026-43838 entry for affected product, then confirm login reachability and patch.","search":"'-10':81B '-20':82B '-2026':11A,14A '-261001':72B '-3600':17A,20B,45B,77B '-43838':12A,15A '2026':80B '30':75B '4.0':63B '9.2':64B 'ac':65B 'achiev':106C 'acirt':71B 'acquisit':52B 'adam':16A,19B,44B,76B 'advantech':21B,43B,69B 'advisori':70B 'allow':102C 'attack':7A,104C 'auth':57B 'base':35B,93C 'buffer':23B,36B,94C 'buffer-overflow':22B 'code':9A,107C 'compon':3A 'could':101C 'cover':73B 'cve':10A,13A 'cves':78B 'cvss':62B 'data':51B 'disclos':79B 'edgelink':18A,25B,46B 'execut':108C 'exploit':89B 'found':83B 'function':41B,100C 'h':66B 'ic':26B 'industri':50B 'interact':60B 'known':88B 'let':6A 'login':2A,40B,99C 'need':61B 'network':54B,86B 'network-reach':53B 'nozomi':85B 'ot':27B 'overflow':5A,24B,37B,95C 'part':67B 'product':32B 'reachabl':55B 'remot':47B 'rtu':29B 'run':8A 'stack':4A,34B,92C 'stack-bas':33B,91C 'termin':48B 'unit':49B 'unknown':31B 'unknown-product':30B 'unnam':1A 'user':59B 'vulner':96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43838","severity":null,"published_at":"2026-10-20T09:17:10+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43838:428","url":null,"severity":null,"published_at":"2026-10-23T23:22:23+00:00","modified_at":"2026-10-23T23:22:23+00:00","first_seen_at":"2026-10-23T23:22:23+00:00","fetched_at":"2026-10-23T23:22:23+00:00","note":"Identified as Advantech ADAM-3600 EdgeLink RTU (ACIRT-261001, batch of ~30 CVEs; CSA SG AL-2026-149; CVE record: affected prior to 2.8.5.0, sibling CVE-2026-43832 reported fixed in 2.8.5.1 by IONIX, so use 2.8.5.1 or later). No exploitation or public PoC found; not KEV; SSVC exploitation none. Advantech advisory body not readable, only index page."}],"documents":[{"id":1912,"url":"https://www.advantech.com/en-us/security-advisory","title":"Advantech Security Advisories (ACIRT-261001, ADAM-3600)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1915,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43838","title":"CVE Record CVE-2026-43838","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}