{"id":"CVE-2026-43855","kind":"vulnerability","aliases":["CVE-2026-43855"],"related":[],"title":"Heap buffer overflow lets an authenticated remote attacker run code","description":"A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.","summary":"Heap-based buffer overflow in Advantech ADAM-3600 EdgeLink remote terminal unit firmware prior to 2.8.5.0. An authenticated remote attacker can achieve arbitrary code execution. Part of a 30-CVE Advantech advisory (ACIRT-261001), found by Nozomi Networks.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","edgelink","heap-overflow","ics","ot","other","rce","rtu"],"not_affected_if":["auth-required"],"how_to_check":"Check the firmware version in the ADAM-3600 EdgeLink web UI or device info; any version below 2.8.5.0 is affected.","fix":"Update ADAM-3600 firmware to 2.8.5.0 or later (per CVE record and Canadian Cyber Centre AV26-1065). Until then, keep the device off untrusted networks.","status":"open","published_at":"2026-10-20T10:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:22:45+00:00","updated_at":"2026-10-25T03:34:01+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:22:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Heap buffer overflow lets an authenticated remote attacker run code","impact":"high","summary":"A heap-based buffer overflow lets a remote attacker who already has an account send crafted input that overwrites memory. The sources say this can lead to arbitrary code execution on the affected system.","category":"other","nicknames":[],"who_cares":[],"confidence":0.3,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the affected system after logging in","analyst_note":"Identify the affected product and vendor from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43855, then find the fixed version and affected configuration.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000492,"input_tokens":3261,"output_tokens":331,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and vendor from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43855, then find the fixed version and affected configuration.","search":"'-2026':12A,15A '-261001':66B '-3600':18A,21B,40B '-43855':13A,16A '2.8.5.0':48B '30':61B 'achiev':54B,85C 'acirt':65B 'adam':17A,20B,39B 'advantech':22B,38B,63B 'advisori':64B 'allow':79C 'arbitrari':55B,86C 'attack':8A,52B,83C 'authent':6A,50B,82C 'base':34B,74C 'buffer':2A,35B,75C 'code':10A,56B,87C 'could':78C 'cve':11A,14A,62B 'edgelink':19A,23B,41B 'execut':57B,88C 'firmwar':45B 'found':67B 'heap':1A,25B,33B,73C 'heap-bas':32B,72C 'heap-overflow':24B 'ic':27B 'let':4A 'network':70B 'nozomi':69B 'ot':28B 'overflow':3A,26B,36B,76C 'part':58B 'prior':46B 'rce':30B 'remot':7A,42B,51B,81C 'rtu':31B 'run':9A 'termin':43B 'unit':44B 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43855","severity":null,"published_at":"2026-10-20T10:17:06+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43855:741","url":null,"severity":null,"published_at":"2026-10-25T03:34:01+00:00","modified_at":"2026-10-25T03:34:01+00:00","first_seen_at":"2026-10-25T03:34:01+00:00","fetched_at":"2026-10-25T03:34:01+00:00","note":"Advantech ADAM-3600 EdgeLink RTU, part of vendor advisory ACIRT-261001 (30 CVEs); fixed in 2.8.5.0 per CVE record and Canada CCCS; vendor PDF read was truncated before this CVE's row, so nothing marked verified. No exploitation or PoC found; not in KEV."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3227,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43855","title":"CVE Record CVE-2026-43855","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}