{"id":"CVE-2026-43844","kind":"vulnerability","aliases":["CVE-2026-43844"],"related":[],"title":"Unnamed proprietary protocol lets attackers bypass authentication entirely","description":"A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.","summary":"Advantech ADAM-3600 EdgeLink remote terminal unit (industrial data acquisition) has an authentication bypass on its proprietary protocol, CVSS 4.0 9.3, network reachable, no privileges needed. Vendor says the cause is a singleton pattern that mixes up commands between TCP ports 6001 and 7001, which differ in what they implement. Found by Nozomi Networks (Simone Bossi, Raffaele Bova). Disclosed to vendor 2026-04-29, patched 2026-10-15, public 2026-10-20. Not known to be exploited.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","authentication-bypass","edgelink","ics","ot","other","rtu","unknown"],"not_affected_if":["firmware-2.8.5.0-or-later","not-network-reachable"],"how_to_check":"Check the EdgeLink image version on each ADAM-3600 (device web UI or firmware info). Anything before 2.8.5.0 is affected. Also check whether TCP ports 6001 and 7001 are reachable from untrusted networks, for example with nmap -p 6001,7001 <device>.","fix":"Update ADAM-3600 EdgeLink firmware to 2.8.5.0 or later (Advantech support page, ADAM-3600-C2G EdgeLink Image). Until then, keep the device off the internet and firewall ports 6001/7001 and the web interface to trusted hosts. Note: the Advantech firmware page I saw listed 2.8.5.0 as Beta, so confirm the release channel.","status":"open","published_at":"2026-10-20T09:17:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:37+00:00","updated_at":"2026-10-23T23:22:24+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:39:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Unnamed proprietary protocol lets attackers bypass authentication entirely","impact":"high","summary":"A flaw in an unnamed proprietary protocol lets an attacker get past its authentication check. The sources do not name the product, the affected versions, or what the attacker can do after logging in.","category":"other","who_cares":["unknown"],"confidence":0.3,"needs_auth":"no","worst_case":"Attacker bypasses login to reach protected protocol functions","analyst_note":"Find the vendor and product behind the proprietary protocol in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43844, then the affected versions and vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000445,"input_tokens":2843,"output_tokens":322,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor and product behind the proprietary protocol in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43844, then the affected versions and vendor advisory.","search":"'-04':92B '-10':96B,100B '-15':97B '-20':101B '-2026':10A,13A '-29':93B '-3600':16A,19B,32B '-43844':11A,14A '2026':91B,95B,99B '4.0':49B '6001':71B '7001':73B '9.3':50B 'acquisit':39B 'adam':15A,18B,31B 'advantech':20B,30B 'allow':114C 'attack':5A,116C 'authent':7A,22B,42B,120C 'authentication-bypass':21B 'bossi':85B 'bova':87B 'bypass':6A,23B,43B,118C 'caus':59B 'command':67B 'could':113C 'cve':9A,12A 'cvss':48B 'data':38B 'differ':75B 'disclos':88B 'edgelink':17A,24B,33B 'entir':8A 'exploit':106B 'found':80B 'ic':25B 'implement':79B 'industri':37B 'known':103B 'let':4A 'mechan':121C 'mix':65B 'need':55B 'network':51B,83B 'nozomi':82B 'ot':26B 'patch':94B 'pattern':63B 'port':70B 'privileg':54B 'proprietari':2A,46B,111C 'protocol':3A,47B,112C 'public':98B 'raffael':86B 'reachabl':52B 'remot':34B 'rtu':28B 'say':57B 'simon':84B 'singleton':62B 'tcp':69B 'termin':35B 'unit':36B 'unknown':29B 'unnam':1A 'vendor':56B,90B 'vulner':108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43844","severity":null,"published_at":"2026-10-20T09:17:10+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43844:427","url":null,"severity":null,"published_at":"2026-10-23T23:22:24+00:00","modified_at":"2026-10-23T23:22:24+00:00","first_seen_at":"2026-10-23T23:22:24+00:00","fetched_at":"2026-10-23T23:22:24+00:00","note":"Advantech ADAM-3600 EdgeLink RTU, one of 30 CVEs in ACIRT-261001 (item 16, NN-2026-0005); fixed in 2.8.5.0. Read vendor PDF + CSA SG alert. No exploitation or public PoC found; X not searched (ICS, low chatter). Advisory lists no public workaround beyond network restriction."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1919,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43844","title":"CVE Record CVE-2026-43844","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}