{"id":"CVE-2026-43845","kind":"vulnerability","aliases":["CVE-2026-43845"],"related":[],"title":"Unnamed product: password reset flaw lets attackers bypass login","description":"A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.","summary":"Advantech ADAM-3600 EdgeLink (industrial remote terminal unit) firmware before 2.8.5.0 has a flaw in its password reset/recovery logic (CWE-640). A remote, unauthenticated attacker can bypass authentication by abusing it. Advantech's advisory says the password was reset to default if the program restarted after an attack-induced exception. CVSS 4.0 9.2. Reported by Nozomi Networks (Simone Bossi, Raffaele Bova). Part of a 30-CVE batch fixed together. No known exploitation.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","auth-bypass","edgelink","ics","ot","other","rtu"],"not_affected_if":["firmware-2.8.5.0-or-later"],"how_to_check":"Check the ADAM-3600 firmware/EdgeLink version in the device web UI or EdgeLink Studio. Anything below 2.8.5.0 is affected. Also check whether the device's management ports (including proprietary protocol ports 6001/7001) are reachable from untrusted networks.","fix":"Upgrade ADAM-3600 firmware to 2.8.5.0 or later. Advantech's fix makes password recovery run only on the first power-on, so a crash and restart no longer resets the password to default. Until patched, restrict network access to the device.","status":"resolved","published_at":"2026-10-20T09:17:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:38+00:00","updated_at":"2026-10-23T23:22:26+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:39:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Unnamed product: password reset flaw lets attackers bypass login","impact":"high","summary":"A flaw in the password reset mechanism of an unnamed product lets an attacker bypass its authentication. The sources do not name the affected product, its versions, or the attack steps.","category":"other","who_cares":[],"confidence":0.3,"needs_auth":"unknown","worst_case":"Attacker gets past login and takes over accounts","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43845 and find the vendor advisory for the fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000636,"input_tokens":2843,"output_tokens":704,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43845 and find the vendor advisory for the fix.","search":"'-2026':11A,14A '-3600':17A,20B,32B '-43845':12A,15A '-640':50B '2.8.5.0':40B '30':95B '4.0':82B '9.2':83B 'abus':59B 'adam':16A,19B,31B 'advantech':21B,30B,61B 'advisori':63B 'allow':111C 'attack':7A,54B,78B,113C 'attack-induc':77B 'auth':23B 'auth-bypass':22B 'authent':57B,117C 'batch':97B 'bossi':89B 'bova':91B 'bypass':8A,24B,56B,115C 'could':110C 'cve':10A,13A,96B 'cvss':81B 'cwe':49B 'default':70B 'edgelink':18A,25B,33B 'except':80B 'exploit':102B 'firmwar':38B 'fix':98B 'flaw':5A,43B 'ic':26B 'induc':79B 'industri':34B 'known':101B 'let':6A 'logic':48B 'login':9A 'mechan':109C,118C 'network':87B 'nozomi':86B 'ot':27B 'part':92B 'password':3A,46B,66B,107C 'product':2A 'program':73B 'raffael':90B 'remot':35B,52B 'report':84B 'reset':4A,68B,108C 'reset/recovery':47B 'restart':74B 'rtu':29B 'say':64B 'simon':88B 'termin':36B 'togeth':99B 'unauthent':53B 'unit':37B 'unnam':1A 'vulner':104C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43845","severity":null,"published_at":"2026-10-20T09:17:10+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43845:426","url":null,"severity":null,"published_at":"2026-10-23T23:22:26+00:00","modified_at":"2026-10-23T23:22:26+00:00","first_seen_at":"2026-10-23T23:22:26+00:00","fetched_at":"2026-10-23T23:22:26+00:00","note":"Product identified as Advantech ADAM-3600 EdgeLink (CNA data in NVD API; Advantech ACIRT-261001 item 17, NN-2026-0006). Fixed in 2.8.5.0 per Advantech/CSA/Canadian Cyber Centre. No exploitation or public PoC found; social search skipped (niche ICS product). One of 30 CVEs in the same advisory."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1922,"url":"https://www.cyber.gc.ca/en/alerts-advisories/control-systems-advantech-security-advisory-av26-1065","title":"Canadian Cyber Centre AV26-1065: Advantech ADAM-3600 prior to v2.8.5.0","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}