{"id":"CVE-2026-43853","kind":"vulnerability","aliases":["CVE-2026-43853"],"related":[],"title":"Crafted message triggers assertion fault and crashes the service","description":"A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.","summary":"Advantech ADAM-3600 EdgeLink (industrial remote terminal unit): a crafted network message triggers a reachable assertion (CWE-617) and crashes the service, denying availability. CVSS 4.0 8.2, no privileges needed. Part of a 30-CVE Advantech batch. No known exploitation or public PoC.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","denial-of-service","edgelink","firmware","ics","other"],"not_affected_if":["firmware-2.8.5.0-or-later","network-isolated"],"how_to_check":"Check the ADAM-3600 firmware version in the device web UI/system info; versions below 2.8.5.0 are affected. Also check whether the device's management/proprietary-protocol ports are reachable from untrusted networks.","fix":"Upgrade ADAM-3600 firmware to 2.8.5.0 or later (vendor patched 2026-10-15). Note: some other CVEs in the same advisory reference 2.8.5.1 for directory restrictions; the latest release covers both. Until patched, restrict network access to the device.","status":"open","published_at":"2026-10-20T10:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:04:11+00:00","updated_at":"2026-10-25T03:34:01+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:04:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Crafted message triggers assertion fault and crashes the service","impact":"low","summary":"A crafted message sent to the affected service triggers an assertion failure. The service then crashes, causing a denial of service.","category":"other","nicknames":[],"who_cares":[],"confidence":0.3,"needs_auth":"unknown","worst_case":"Service crashes and becomes unavailable until restarted","analyst_note":"Sources do not name the product, versions or message type; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43853 for affected products and fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000477,"input_tokens":3254,"output_tokens":304,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not name the product, versions or message type; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43853 for affected products and fixed versions.","search":"'-2026':11A,14A '-3600':17A,20B,31B '-43853':12A,15A '-617':46B '30':62B '4.0':54B '8.2':55B 'adam':16A,19B,30B 'advantech':21B,29B,64B 'allow':75C 'assert':4A,44B,86C 'attack':77C 'avail':52B 'batch':65B 'caus':88C 'could':74C 'craft':1A,38B,81C 'crash':7A,48B,92C 'cve':10A,13A,63B 'cvss':53B 'cwe':45B 'deni':51B 'denial':23B 'denial-of-servic':22B 'edgelink':18A,26B,32B 'exploit':68B 'fault':5A,87C 'firmwar':27B 'ic':28B 'industri':33B 'known':67B 'messag':2A,40B,82C 'need':58B 'network':39B 'part':59B 'poc':71B 'privileg':57B 'public':70B 'reachabl':43B 'remot':34B 'send':79C 'servic':9A,25B,50B,90C 'termin':35B 'trigger':3A,41B,84C 'unit':36B 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Advantech ADAM-3600 EdgeLink RTUs on firmware before 2.8.5.0, typically industrial data acquisition and remote monitoring sites. An attacker who can reach the device over the network can crash the service without logging in. Teams without ADAM-3600 devices, or with devices isolated from untrusted networks, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43853","severity":null,"published_at":"2026-10-20T10:17:06+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43853:742","url":null,"severity":null,"published_at":"2026-10-25T03:34:01+00:00","modified_at":"2026-10-25T03:34:01+00:00","first_seen_at":"2026-10-25T03:34:01+00:00","fetched_at":"2026-10-25T03:34:01+00:00","note":"Identified as Advantech ADAM-3600 EdgeLink (vendor advisory ACIRT-261001 item 25, NN-2026-0014; CSA SG AL-2026-149). Vendor PDF row text truncated in my read; fixed version 2.8.5.0 comes from CSA-sourced NVD record and secondary trackers, not read in vendor words, so nothing marked verified. No exploitation or PoC found."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}