{"id":"CVE-2026-43850","kind":"vulnerability","aliases":["CVE-2026-43850"],"related":[],"title":"Unnamed product: authenticated command injection grants root code execution","description":"A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.","summary":"Authenticated command injection (CWE-77) in Advantech ADAM-3600 EdgeLink remote terminal unit firmware lets a logged-in user run commands as root. Fixed in firmware 2.8.5.0. One of ~30 CVEs in Advantech advisory ACIRT-261001. Found by Nozomi Networks. No known exploitation.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","command-injection","firmware","ics","ot","other"],"not_affected_if":["no-adam-3600","unauthenticated-only-deployments"],"how_to_check":"Check the ADAM-3600 firmware version in the device web UI; anything below 2.8.5.0 is affected. Also check whether the management interface is reachable from untrusted networks.","fix":"Update ADAM-3600 firmware to 2.8.5.0 or later per Advantech advisory ACIRT-261001 (advantech.com/en-us/security-advisory). Until then, restrict management access to trusted networks and rotate device credentials.","status":"open","published_at":"2026-10-20T10:17:05+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:43+00:00","updated_at":"2026-10-24T00:15:59+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Unnamed product: authenticated command injection grants root code execution","impact":"high","summary":"A command injection flaw lets a logged-in user run commands as root on the affected system. The sources do not name the product or version.","category":"other","who_cares":[],"confidence":0.4,"needs_auth":"yes","worst_case":"authenticated user runs arbitrary commands as root on the system","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43850 and check the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unauthenticated-only-deployments"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000432,"input_tokens":2840,"output_tokens":295,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43850 and check the vendor advisory.","search":"'-2026':11A,14A '-261001':63B '-3600':17A,19B,35B '-43850':12A,15A '-77':31B '2.8.5.0':54B '30':57B 'achiev':81C 'acirt':62B 'adam':16A,18B,34B 'advantech':20B,33B,60B 'advisori':61B 'allow':76C 'attack':79C 'authent':3A,27B,78C 'code':8A,85C 'command':4A,22B,28B,48B,72C 'command-inject':21B 'could':75C 'cve':10A,13A 'cves':58B 'cwe':30B 'edgelink':36B 'execut':9A,86C 'exploit':70B 'firmwar':24B,40B,53B 'fix':51B 'found':64B 'grant':6A 'ic':25B 'inject':5A,23B,29B,73C 'known':69B 'let':41B 'level':84C 'log':44B 'logged-in':43B 'network':67B 'nozomi':66B 'one':55B 'ot':26B 'product':2A 'remot':37B 'root':7A,50B,83C 'root-level':82C 'run':47B 'system':89C 'termin':38B 'unit':39B 'unnam':1A 'user':46B 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43850","severity":null,"published_at":"2026-10-20T10:17:05+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43850:622","url":null,"severity":null,"published_at":"2026-10-24T00:15:59+00:00","modified_at":"2026-10-24T00:15:59+00:00","first_seen_at":"2026-10-24T00:15:59+00:00","fetched_at":"2026-10-24T00:15:59+00:00","note":"Product identified as Advantech ADAM-3600 (EdgeLink RTU), firmware < 2.8.5.0, via CVE.org record, CSA Singapore AL-2026-149 and Advantech ACIRT-261001 listing; vendor patched 2026-10-15. No exploitation or PoC found; X not searched (OT device)."}],"documents":[{"id":1930,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149/","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1912,"url":"https://www.advantech.com/en-us/security-advisory","title":"Advantech Security Advisories (ACIRT-261001, ADAM-3600)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2513,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43850","title":"CVE Record CVE-2026-43850","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}