{"id":"CVE-2026-43858","kind":"vulnerability","aliases":["CVE-2026-43858"],"related":[],"title":"Stack buffer overflow lets an authenticated remote user run code","description":"A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.","summary":"Stack-based buffer overflow in Advantech ADAM-3600 EdgeLink industrial RTU firmware before 2.8.5.0. A remote attacker with high-privilege credentials can run arbitrary code. Part of a batch of about 30 ADAM-3600 CVEs disclosed 2026-10-20 (found by Nozomi Networks). Vendor patched 2026-10-15. No known exploitation.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","advantech","edgelink","firmware","ics","other","rce"],"not_affected_if":["auth-required"],"how_to_check":"Check the ADAM-3600 firmware version in the device web UI or EdgeLink tooling. Anything below 2.8.5.0 is affected. Find exposed devices by checking whether the management interface is reachable from untrusted networks.","fix":"Update ADAM-3600 firmware to 2.8.5.0 or later (see https://www.advantech.com/en/security-advisory). Do not expose the management interface to the internet, and restrict admin credentials.","status":"resolved","published_at":"2026-10-20T10:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:41+00:00","updated_at":"2026-10-24T00:14:52+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:39:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Stack buffer overflow lets an authenticated remote user run code","impact":"high","summary":"A stack-based buffer overflow allows a remote attacker with valid credentials to overwrite memory and execute arbitrary code. NVD rates it high (CVSS 8.6) and the sources do not name the affected product.","category":"other","who_cares":[],"confidence":0.4,"needs_auth":"yes","worst_case":"Remote authenticated attacker runs arbitrary code on the affected host.","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43858 and find the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000448,"input_tokens":2855,"output_tokens":325,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-43858 and find the vendor advisory.","search":"'-10':66B,75B '-15':76B '-20':67B '-2026':12A,15A '-3600':18A,20B,35B,62B '-43858':13A,16A '2.8.5.0':41B '2026':65B,74B '30':60B 'achiev':94C 'adam':17A,19B,34B,61B 'advantech':21B,33B 'allow':88C 'arbitrari':52B,95C 'attack':44B,92C 'authent':6A,91C 'base':29B,83C 'batch':57B 'buffer':2A,30B,84C 'code':10A,53B,96C 'could':87C 'credenti':49B 'cve':11A,14A 'cves':63B 'disclos':64B 'edgelink':22B,36B 'execut':97C 'exploit':79B 'firmwar':23B,39B 'found':68B 'high':47B 'high-privileg':46B 'ic':24B 'industri':37B 'known':78B 'let':4A 'network':71B 'nozomi':70B 'overflow':3A,31B,85C 'part':54B 'patch':73B 'privileg':48B 'rce':26B 'remot':7A,43B,90C 'rtu':38B 'run':9A,51B 'stack':1A,28B,82C 'stack-bas':27B,81C 'user':8A 'vendor':72B 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43858","severity":null,"published_at":"2026-10-20T10:17:06+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43858:619","url":null,"severity":null,"published_at":"2026-10-24T00:14:52+00:00","modified_at":"2026-10-24T00:14:52+00:00","first_seen_at":"2026-10-24T00:14:52+00:00","fetched_at":"2026-10-24T00:14:52+00:00","note":"Product identified as Advantech ADAM-3600 EdgeLink RTU, affected < 2.8.5.0 (NVD/CVE record), one of ~30 CVEs in CSA AL-2026-149 (vendor patched 2026-10-15). Advantech advisory page is generic; exact fixed build number and per-CVE detail not read, so fixed is inferred as 2.8.5.0. No exploitation or PoC found; CISA SSVC exploitation none. Social search skipped (no CVE-specific chatter expected)."}],"documents":[{"id":1930,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149/","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2495,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-43858","title":"NVD record CVE-2026-43858 (Advantech ADAM-3600 < 2.8.5.0)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}