{"id":"CVE-2026-43839","kind":"vulnerability","aliases":["CVE-2026-43839"],"related":[],"title":"Unnamed logs management component: unauthenticated NULL dereference crashes service","description":"A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.","summary":"Advantech ADAM-3600 EdgeLink remote terminal unit: a NULL pointer dereference in the logs management function lets an unauthenticated network attacker crash the service (denial of service, CVSS 4.0 8.7). One of 30 CVEs in Advantech advisory ACIRT-261001, patched 2026-10-15, public 2026-10-20. Discovered by Nozomi Networks. Not known to be exploited.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":[],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","denial-of-service","edgelink","ics","logs-management","other","rtu"],"not_affected_if":["not-network-reachable"],"how_to_check":"Open the ADAM-3600 EdgeLink firmware/version page in the device web UI. Any version below 2.8.5.0 is affected per the CVE record. Also check whether the device's management interface is reachable from untrusted networks.","fix":"Update ADAM-3600 EdgeLink to the latest firmware from Advantech (advisory ACIRT-261001). Exact fixed version is unconfirmed: the CVE record says affected prior to 2.8.5.0, and a third party cites 2.8.5.1 for a sibling CVE. Until patched, keep the device off the internet and behind a firewall or segmented OT network.","status":"open","published_at":"2026-10-20T09:17:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:37:27+00:00","updated_at":"2026-10-24T00:17:07+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-23T22:37:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Unnamed logs management component: unauthenticated NULL dereference crashes service","impact":"low","summary":"A NULL pointer dereference in the logs management functionality of an unnamed product can be triggered by an unauthenticated attacker. The result is a crash of the service, which is a denial of service.","category":"other","who_cares":["logs-management"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated attacker crashes the service repeatedly, causing denial of service.","analyst_note":"Identify the affected product, its versions and the fixed release from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43839.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000822,"input_tokens":2849,"output_tokens":1075,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product, its versions and the fixed release from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43839.","search":"'-10':74B,78B '-15':75B '-20':79B '-2026':11A,14A '-261001':71B '-3600':17A,20B,35B '-43839':12A,15A '2026':73B,77B '30':65B '4.0':61B '8.7':62B 'acirt':70B 'adam':16A,19B,34B 'advantech':21B,33B,68B 'advisori':69B 'allow':100C 'attack':53B,103C 'compon':4A 'could':99C 'crash':8A,54B,105C 'cve':10A,13A 'cves':66B 'cvss':60B 'denial':23B,57B 'denial-of-servic':22B 'derefer':7A,43B,92C 'discov':80B 'edgelink':18A,26B,36B 'exploit':88B 'function':48B,98C 'ic':27B 'known':85B 'let':49B 'log':2A,29B,46B,96C 'logs-manag':28B 'manag':3A,30B,47B,97C 'network':52B,83B 'nozomi':82B 'null':6A,41B,90C 'one':63B 'patch':72B 'pointer':42B,91C 'public':76B 'remot':37B 'rtu':32B 'servic':9A,25B,56B,59B,107C 'termin':38B 'unauthent':5A,51B,102C 'unit':39B 'unnam':1A 'vulner':93C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43839","severity":null,"published_at":"2026-10-20T09:17:10+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43839:625","url":null,"severity":null,"published_at":"2026-10-24T00:17:07+00:00","modified_at":"2026-10-24T00:17:07+00:00","first_seen_at":"2026-10-24T00:17:07+00:00","fetched_at":"2026-10-24T00:17:07+00:00","note":"Product identified as Advantech ADAM-3600 EdgeLink RTU (Advantech ACIRT-261001, CSA SG AL-2026-149, CVE record: affected prior to 2.8.5.0). Exact fixed build not read on a primary page; IONIX cites 2.8.5.1 for sibling CVE-2026-43832. No exploitation or PoC seen; no social chatter searched (obscure ICS product)."}],"documents":[{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2527,"url":"https://www.advantech.com/en/security-advisory","title":"Advantech Security Advisories, ACIRT-261001 Vulnerabilities Identified in ADAM-3600","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2528,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43839","title":"CVE Record CVE-2026-43839 (affected: prior to 2.8.5.0)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}