{"id":"CVE-2026-43852","kind":"vulnerability","aliases":["CVE-2026-43852"],"related":[],"title":"Authenticated attacker can write files to arbitrary system locations","description":"A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.","summary":"Advantech ADAM-3600 EdgeLink RTU: an authenticated user can write files to arbitrary locations through a path traversal (../) in the project file download handler (mod_projectmr, message ID 101). It is one of 30 CVEs fixed in the same advisory. No exploitation or public PoC found.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","edgelink","ics","other","path-traversal","rtu"],"not_affected_if":["auth-required","not-exposed-to-network"],"how_to_check":"Check the ADAM-3600 firmware/EdgeLink version in the device web UI; versions prior to 2.8.5.0 are affected per CVE record and Canadian Cyber Centre AV26-1065. Also check whether the device's project-transfer service is reachable from untrusted networks.","fix":"Update ADAM-3600 to 2.8.5.0 or later (CVE record: affected prior to 2.8.5.0). The vendor PDF's sibling item for CVE-2026-43851 says read/write directories are restricted starting from 2.8.5.1 (Standard and SE editions); the fix cell for this CVE was cut off in what I read, so prefer 2.8.5.1 or the latest and confirm in the vendor PDF.","status":"open","published_at":"2026-10-20T10:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:04:12+00:00","updated_at":"2026-10-25T03:34:00+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-25T03:04:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Authenticated attacker can write files to arbitrary system locations","impact":"high","summary":"An attacker with a valid account can write files to arbitrary locations on the affected system. The sources do not name the product, so the impact on code execution or data access is not confirmed.","category":"other","nicknames":[],"who_cares":[],"confidence":0.3,"needs_auth":"yes","worst_case":"Attacker writes arbitrary files, possibly overwriting system or application files","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43852 and find the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000485,"input_tokens":3242,"output_tokens":321,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43852 and find the vendor advisory.","search":"'-2026':11A,14A '-3600':17A,19B,30B '-43852':12A,15A '101':56B '30':61B 'adam':16A,18B,29B 'advantech':20B,28B 'advisori':67B 'allow':77C 'arbitrari':7A,40B,85C 'attack':2A,80C 'authent':1A,34B,79C 'could':76C 'cve':10A,13A 'cves':62B 'download':50B 'edgelink':21B,31B 'exploit':69B 'file':5A,38B,49B,83C 'fix':63B 'found':73B 'handler':51B 'ic':22B 'id':55B 'locat':9A,41B,86C 'messag':54B 'mod':52B 'one':59B 'path':25B,44B 'path-travers':24B 'poc':72B 'project':48B 'projectmr':53B 'public':71B 'rtu':27B,32B 'system':8A,89C 'travers':26B,45B 'user':35B 'vulner':75C 'write':4A,37B,82C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Advantech ADAM-3600 EdgeLink remote terminal units (industrial data acquisition and remote monitoring) on firmware before 2.8.5.0. The attacker needs a valid account on the device, but the CVSS rates privileges as high and attack as network-reachable, so devices reachable from corporate or internet networks matter most. Teams without ADAM-3600 devices can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43852","severity":null,"published_at":"2026-10-20T10:17:06+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43852:743","url":null,"severity":null,"published_at":"2026-10-25T03:34:00+00:00","modified_at":"2026-10-25T03:34:00+00:00","first_seen_at":"2026-10-25T03:34:00+00:00","fetched_at":"2026-10-25T03:34:00+00:00","note":"Product identified as Advantech ADAM-3600 (EdgeLink RTU), vendor advisory ACIRT-261001 item 24 (NN-2026-0013): path traversal in CommandFileDownload::Execute, message ID 101 (Download Start). Vendor PDF text was truncated at the fix cell for this item, so exact fix version not confirmed; no verify marks."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3224,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43852","title":"CVE Record CVE-2026-43852","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}