---
id: "CVE-2026-43856"
kind: "vulnerability"
aliases: ["CVE-2026-43856"]
title: "FileProcess::CheckDir stack overflow lets authenticated remote user run code"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "ADAM-3600 EdgeLink", "fixed": ["2.8.5.0"], "affected": "< 2.8.5.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adam-3600", "advantech", "buffer-overflow", "edgelink", "ics", "other", "rce", "rtu", "unknown"]
not_affected_if: ["auth-required", "not-internet-exposed"]
published_at: "2026-10-20T10:17:06+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-24T00:16:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43856", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:16:06+00:00"}]
---

# FileProcess::CheckDir stack overflow lets authenticated remote user run code

Stack-based buffer overflow in FileProcess::CheckDir on Advantech ADAM-3600 EdgeLink remote terminal units. An authenticated remote user (high privileges) sending a path over 1024 bytes can get code execution on the device. It is one of about 30 CVEs fixed in the same Advantech advisory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ADAM-3600 EdgeLink affected < 2.8.5.0 fixed 2.8.5.0

## How to check

Look at the ADAM-3600 EdgeLink firmware/software version in the device web UI or EdgeLink tooling. Anything before 2.8.5.0 is affected. Also check whether the device's management or EdgeLink ports are reachable from untrusted networks.

## Fix

Upgrade ADAM-3600 EdgeLink to 2.8.5.0 or later (note the vendor mentions 2.8.5.1 for other fixes in the same advisory; prefer the latest release from Advantech). Until then, keep the device off the internet and restrict access to trusted admin hosts, and rotate admin credentials.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-43856
- 2026-10-24T00:16:06+00:00 analyst — Advantech ADAM-3600 EdgeLink (RTU), found by Nozomi Networks; CVE record says affected prior to 2.8.5.0, vendor patched 2026-10-15 (ACIRT-261001), public 2026-10-20. No KEV, no public PoC seen. Vendor PDF row for this CVE was truncated in my read, so the exact fixed build is from the CVE record and Mallory. Did not search X, as an ICS device has little chatter.

## Documents

- [advisory] Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001) https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf
- [describes] CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149/
- [describes] CVE Record: CVE-2026-43856 https://www.cve.org/CVERecord?id=CVE-2026-43856

## From the sources

A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_