Live › vulnerability › CVE-2026-43852
Go to dashboardAdvantech ADAM-3600 EdgeLink RTU: an authenticated user can write files to arbitrary locations through a path traversal (../) in the project file download handler (mod_projectmr, message ID 101). It is one of 30 CVEs fixed in the same advisory. No exploitation or public PoC found.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Advantech ADAM-3600 EdgeLink remote terminal units (industrial data acquisition and remote monitoring) on firmware before 2.8.5.0. The attacker needs a valid account on the device, but the CVSS rates privileges as high and attack as network-reachable, so devices reachable from corporate or internet networks matter most. Teams without ADAM-3600 devices can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ADAM-3600 | vendor | < 2.8.5.0 | 2.8.5.0 |
2.8.5.0 are affected per CVE record and Canadian Cyber Centre AV26-10652.8.5.0 or later (CVE record: affected prior to 2.8.5.0)2.8.5.1 (Standard and SE editions); the fix cell for this CVE was cut off in what I read, so prefer 2.8.5.1 or the latest and confirm in the vendor PDFEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
This page as .md · .json · in your agent: get_signal("CVE-2026-43852")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.