Live › vulnerability › CVE-2026-43851
Go to dashboardAdvantech ADAM-3600 EdgeLink RTU: a path traversal in the project file transfer handler (mod_projectmr, message ID 104 Upload Start) lets an authenticated user use ../ sequences to read any file on the device. Part of a 30-CVE batch fixed in the same update.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ADAM-3600 | vendor | < 2.8.5.0 | 2.8.5.0 |
2.8.5.0 are affected, and per the vendor's text for this CVE the directory restriction arrives in 2.8.5.12.8.5.1 or later (CVE record says fixed in 2.8.5.0; vendor's solution for this CVE cites 2.8.5.1, which limits read/write to /tmp and /home/sysuser, or /tmp, /home/sysuser/project, /home/www/xml in the SE edition)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
This page as .md · .json · in your agent: get_signal("CVE-2026-43851")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.