Advantech Patches 30 Flaws in ADAM-3600 Industrial RTU, Including Critical RCE Bugs
Do Son 
TL;DR
Singapore’s Cyber Security Agency disclosed 30 Advantech ADAM-3600 vulnerabilities on October 20, 2026. Seven are critical, and several allow unauthenticated remote code execution or authentication bypass. EdgeLink version 2.8.5.0 fixes them all.
- Total: 30 CVEs
- Severity: 8 Critical · 15 High · 7 Medium
- Actively exploited: None confirmed
- Highest severity: 9.8 (Critical · CVSSv3) — CVE-2026-43830
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-43830 | 9.8 | CWE-77 | Not exploited |
| CVE-2026-43836 | 9.3 | Awaiting analysis | Not exploited |
| CVE-2026-43844 | 9.3 | Awaiting analysis | Not exploited |
| CVE-2026-43838 | 9.2 | Awaiting analysis | Not exploited |
| CVE-2026-43845 | 9.2 | Awaiting analysis | Not exploited |
| CVE-2026-43829 | 7.5 | CWE-121 | Not exploited |
| CVE-2026-43831 | 7.5 | CWE-121 | Not exploited |
| CVE-2026-43832 | 7.5 | CWE-121 | Not exploited |
Why It Matters
The ADAM-3600 is a remote terminal unit (RTU) used for industrial data collection and remote monitoring. It often sits in utilities and factory sites. A hijacked RTU could feed false data to operators or disrupt field equipment.
How the Attacks Work
Critical flaws (CVSS 9.2-9.3)
- CVE-2026-43836: a forged packet in the proprietary protocol can run commands “with maximum privileges.”
- CVE-2026-43844: a proprietary protocol flaw that bypasses authentication.
- CVE-2026-43845: a password reset flaw that also bypasses login.
- Four buffer overflows in the password, log, cookie and login functions enable code execution, mostly without authentication.
Other Advantech ADAM-3600 vulnerabilities
Notably, two of the critical overflows only apply when the SafeEnhancement feature is on. In addition, one brute-force flaw works “even when the SafeEnhancement feature is enabled.”
The remaining flaws include command injection, forged firmware uploads, path traversal and arbitrary file writes. One firmware flaw could compromise “the device permanently.” Another enables remote code execution as root through command injection. Several more can crash services without a login.
Exploitation status
No exploitation in the wild or public PoC has been confirmed. None of the flaws appear in CISA’s KEV catalog. Simone Bossi and Raffaele Bova of Nozomi Networks reported them, according to the CVE records.
Affected Versions
All Advantech ADAM-3600 EdgeLink versions before 2.8.5.0 are affected.
Patch and Mitigation Steps
- Update EdgeLink to version 2.8.5.0 or later. Advantech released the fix on October 15.
- Keep RTUs off the internet and behind firewalls.
- Restrict access to the proprietary protocol and web interface to trusted hosts.
The CSA alert on the ADAM-3600 flaws urges admins to update “immediately.” Given the number of unauthenticated remote code execution paths, operators should treat these Advantech ADAM-3600 vulnerabilities as urgent.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
