{"id":"CVE-2026-43856","kind":"vulnerability","aliases":["CVE-2026-43856"],"related":[],"title":"FileProcess::CheckDir stack overflow lets authenticated remote user run code","description":"A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.","summary":"Stack-based buffer overflow in FileProcess::CheckDir on Advantech ADAM-3600 EdgeLink remote terminal units. An authenticated remote user (high privileges) sending a path over 1024 bytes can get code execution on the device. It is one of about 30 CVEs fixed in the same Advantech advisory.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600 EdgeLink","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","buffer-overflow","edgelink","ics","other","rce","rtu","unknown"],"not_affected_if":["auth-required","not-internet-exposed"],"how_to_check":"Look at the ADAM-3600 EdgeLink firmware/software version in the device web UI or EdgeLink tooling. Anything before 2.8.5.0 is affected. Also check whether the device's management or EdgeLink ports are reachable from untrusted networks.","fix":"Upgrade ADAM-3600 EdgeLink to 2.8.5.0 or later (note the vendor mentions 2.8.5.1 for other fixes in the same advisory; prefer the latest release from Advantech). Until then, keep the device off the internet and restrict access to trusted admin hosts, and rotate admin credentials.","status":"open","published_at":"2026-10-20T10:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:41+00:00","updated_at":"2026-10-24T00:16:06+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FileProcess::CheckDir stack overflow lets authenticated remote user run code","impact":"high","summary":"A stack-based buffer overflow in the FileProcess::CheckDir function is triggered by a path longer than 1024 bytes. A remote attacker with a valid account can use it to execute arbitrary code.","category":"other","who_cares":["unknown"],"confidence":0.3,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the affected server after logging in","analyst_note":"Sources do not name the affected product or vendor; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43856 for the product, affected versions and patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000453,"input_tokens":2883,"output_tokens":329,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not name the affected product or vendor; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43856 for the product, affected versions and patch.","search":"'-2026':12A,15A '-3600':18A,21B,43B '-43856':13A,16A '1024':58B,108C '30':72B 'achiev':99C 'adam':17A,20B,42B 'advantech':22B,41B,78B 'advisori':79B 'allow':93C 'arbitrari':100C 'attack':97C 'authent':6A,49B,96C 'base':34B,83C 'buffer':24B,35B,84C 'buffer-overflow':23B 'byte':59B,109C 'checkdir':2A,39B,90C 'code':10A,62B,101C 'could':92C 'cve':11A,14A 'cves':73B 'devic':66B 'edgelink':19A,26B,44B 'execut':63B,102C 'fileprocess':1A,38B,89C 'fix':74B 'function':91C 'get':61B 'high':52B 'ic':27B 'let':5A 'longer':106C 'one':69B 'overflow':4A,25B,36B,85C 'path':56B,105C 'privileg':53B 'rce':29B 'remot':7A,45B,50B,95C 'rtu':30B 'run':9A 'send':54B 'stack':3A,33B,82C 'stack-bas':32B,81C 'termin':46B 'unit':47B 'unknown':31B 'user':8A,51B 'via':103C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43856","severity":null,"published_at":"2026-10-20T10:17:06+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43856:621","url":null,"severity":null,"published_at":"2026-10-24T00:16:06+00:00","modified_at":"2026-10-24T00:16:06+00:00","first_seen_at":"2026-10-24T00:16:06+00:00","fetched_at":"2026-10-24T00:16:06+00:00","note":"Advantech ADAM-3600 EdgeLink (RTU), found by Nozomi Networks; CVE record says affected prior to 2.8.5.0, vendor patched 2026-10-15 (ACIRT-261001), public 2026-10-20. No KEV, no public PoC seen. Vendor PDF row for this CVE was truncated in my read, so the exact fixed build is from the CVE record and Mallory. Did not search X, as an ICS device has little chatter."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1930,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149/","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2518,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43856","title":"CVE Record: CVE-2026-43856","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}