{"id":"CVE-2026-43857","kind":"vulnerability","aliases":["CVE-2026-43857"],"related":[],"title":"Authenticated remote attacker can run code with service privileges","description":"A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.","summary":"Advantech ADAM-3600 EdgeLink (industrial remote terminal unit) has a flaw that lets a remote, authenticated attacker run arbitrary code with the privileges of the service. It is one of about 30 CVEs fixed in Advantech advisory ACIRT-261001. Reported by Nozomi Networks researchers. No exploitation or public PoC known.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","ics","ot","other","rce"],"not_affected_if":["auth-required"],"how_to_check":"Check the ADAM-3600 firmware version in the device web UI or management interface; versions below 2.8.5.0 are affected. Also check whether the device management/web service is reachable from untrusted networks.","fix":"Update ADAM-3600 firmware to 2.8.5.0 or later (per the CVE record, versions prior to 2.8.5.0 are affected; get the update from Advantech, advisory ACIRT-261001). Until then, restrict network access to the device and limit the accounts that can log in.","status":"open","published_at":"2026-10-20T10:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:41+00:00","updated_at":"2026-10-24T00:14:57+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Authenticated remote attacker can run code with service privileges","impact":"high","summary":"A remote attacker who holds a valid account can run arbitrary code with the privileges of the affected service. The sources do not name the product or versions, so the exact affected software is unknown.","category":"other","who_cares":[],"confidence":0.4,"needs_auth":"yes","worst_case":"Code runs with service privileges after the attacker logs in","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43857 and find the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000434,"input_tokens":2849,"output_tokens":298,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43857 and find the vendor advisory.","search":"'-2026':11A,14A '-261001':63B '-3600':17A,19B,27B '-43857':12A,15A '30':56B 'achiev':84C 'acirt':62B 'adam':16A,18B,26B 'advantech':20B,25B,60B 'advisori':61B 'allow':78C 'arbitrari':43B,85C 'attack':3A,41B,82C 'authent':1A,40B,81C 'code':6A,44B,86C 'could':77C 'cve':10A,13A 'cves':57B 'edgelink':28B 'execut':87C 'exploit':70B 'fix':58B 'flaw':35B 'ic':21B 'industri':29B 'known':74B 'let':37B 'network':67B 'nozomi':66B 'one':53B 'ot':22B 'poc':73B 'privileg':9A,47B,89C 'public':72B 'rce':24B 'remot':2A,30B,39B,80C 'report':64B 'research':68B 'run':5A,42B 'servic':8A,50B,92C 'termin':31B 'unit':32B 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43857","severity":null,"published_at":"2026-10-20T10:17:06+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43857:620","url":null,"severity":null,"published_at":"2026-10-24T00:14:57+00:00","modified_at":"2026-10-24T00:14:57+00:00","first_seen_at":"2026-10-24T00:14:57+00:00","fetched_at":"2026-10-24T00:14:57+00:00","note":"Identified via CVE.org record and CSA AL-2026-149: Advantech ADAM-3600 EdgeLink RTU, affected prior to 2.8.5.0, vendor advisory ACIRT-261001 (2026-10-15). Not read: Advantech advisory body (listing only), so exact fixed build is inferred as 2.8.5.0. No exploitation or PoC found; no X search done."}],"documents":[{"id":1930,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149/","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1912,"url":"https://www.advantech.com/en-us/security-advisory","title":"Advantech Security Advisories (ACIRT-261001, ADAM-3600)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2502,"url":"https://www.cve.org/CVERecord?id=CVE-2026-43857","title":"CVE Record CVE-2026-43857","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}