{"id":"CVE-2026-43846","kind":"vulnerability","aliases":["CVE-2026-43846"],"related":[],"title":"Stack buffer overflow in a non-functional feature allows code execution","description":"A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.","summary":"Stack-based buffer overflow in a non-functional feature of Advantech ADAM-3600 EdgeLink remote terminal units. An authenticated, high-privilege network attacker can get code execution. CVSS 4.0 8.6. Part of a batch of about 30 ADAM-3600 CVEs disclosed 2026-10-20; the vendor patched 2026-10-15. No known exploitation or public PoC.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","edgelink","firmware","ics","other","rce","unknown"],"not_affected_if":["firmware-2.8.5.0-or-later","not-using-adam-3600","unknown"],"how_to_check":"Check the ADAM-3600 firmware version in the device web UI or EdgeLink management; versions below 2.8.5.0 are affected. Also check whether the management interface is reachable from untrusted networks.","fix":"Update ADAM-3600 firmware to 2.8.5.0 or later (inferred from 'prior to 2.8.5.0'; confirm on the Advantech security advisory page). Restrict management access to trusted networks and use strong admin credentials.","status":"open","published_at":"2026-10-20T09:17:11+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:43+00:00","updated_at":"2026-10-24T00:15:58+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:39:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Stack buffer overflow in a non-functional feature allows code execution","impact":"high","summary":"A stack-based buffer overflow sits in a feature that does not work in practice, according to the advisory. An attacker who has a valid account can overflow the stack and run code.","category":"other","who_cares":["unknown"],"confidence":0.3,"needs_auth":"yes","worst_case":"attacker with an account runs code on the affected machine","analyst_note":"Sources give only the NVD description; identify the affected product and version from https://nvd.nist.gov/vuln/detail/CVE-2026-43846 and the vendor advisory it links.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000438,"input_tokens":2853,"output_tokens":305,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give only the NVD description; identify the affected product and version from https://nvd.nist.gov/vuln/detail/CVE-2026-43846 and the vendor advisory it links.","search":"'-10':75B,81B '-15':82B '-20':76B '-2026':14A,17A '-3600':20A,22B,44B,71B '-43846':15A,18A '2026':74B,80B '30':69B '4.0':61B '8.6':62B 'achiev':108C 'adam':19A,21B,43B,70B 'advantech':23B,42B 'allow':10A,103C 'attack':55B,106C 'authent':50B,105C 'base':32B,92C 'batch':66B 'buffer':2A,33B,93C 'code':11A,58B,109C 'could':102C 'cve':13A,16A 'cves':72B 'cvss':60B 'disclos':73B 'edgelink':24B,45B 'execut':12A,59B,110C 'exploit':85B 'featur':9A,40B,101C 'firmwar':25B 'function':8A,39B,100C 'get':57B 'high':52B 'high-privileg':51B 'ic':26B 'known':84B 'network':54B 'non':7A,38B,99C 'non-funct':6A,37B,98C 'overflow':3A,34B,94C 'part':63B 'patch':79B 'poc':88B 'privileg':53B 'public':87B 'rce':28B 'remot':46B 'stack':1A,31B,91C 'stack-bas':30B,90C 'termin':47B 'unit':48B 'unknown':29B 'vendor':78B 'vulner':95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43846","severity":null,"published_at":"2026-10-20T09:17:11+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43846:624","url":null,"severity":null,"published_at":"2026-10-24T00:15:58+00:00","modified_at":"2026-10-24T00:15:58+00:00","first_seen_at":"2026-10-24T00:15:58+00:00","fetched_at":"2026-10-24T00:15:58+00:00","note":"Advantech ADAM-3600 EdgeLink RTU; CVE record says affected prior to 2.8.5.0 (fixed version inferred, vendor page advantech.com/en/security-advisory not read directly). Part of CSA AL-2026-149 batch of ~30 CVEs (43829-43858). No exploitation or PoC found, not in KEV. No community posts searched (industrial product, CVE id only)."}],"documents":[{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2511,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43846","title":"CVE Record CVE-2026-43846 (affected: prior to 2.8.5.0)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}