EUVD-2026-51385
GHSA-qfcq-v28c-qmm4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible unauthenticated RCE yields full C/I/A impact; AC:L because no special timing or race condition is described beyond the feature prerequisite.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
Lifecycle Timeline
6DescriptionCVE.org
Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a stack-based buffer overflow in the password functionality to conduct code execution when the SafeEnhancement feature is enabled.
AnalysisAI
Stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's password handling routine enables unauthenticated remote code execution when the SafeEnhancement feature is active. All firmware versions prior to 2.8.5.1 are affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface on an industrial IoT edge device warrants prompt patching given OT environment exposure.
Technical ContextAI
The Advantech ADAM-3600 EdgeLink (CPE: cpe:2.3:a:advantech:adam-3600_edgelink:*:*:*:*:*:*:*:*) is an industrial IoT edge computing gateway designed for data acquisition and protocol conversion in OT environments. The vulnerability is rooted in CWE-121 (Stack-Based Buffer Overflow): the password-processing routine fails to validate input length before copying data onto the stack, enabling a controlled overwrite of the return address or adjacent stack frame. The prerequisite is that the SafeEnhancement feature is enabled, suggesting this code path is only active under that specific device configuration mode. Because the password functionality is reachable over the network prior to authentication, the overflow is exploitable remotely without credentials.
RemediationAI
Upgrade ADAM-3600 EdgeLink firmware to version 2.8.5.1 or later as the primary remediation; the fix version is confirmed by the EUVD entry and referenced in the CSA advisory at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-097. If immediate patching is not feasible, disable the SafeEnhancement feature if it is not operationally required - this removes the vulnerable code path entirely, though the trade-off is loss of whatever enhanced functionality that mode provides. As an additional compensating control, restrict network access to the device's management and authentication interfaces via firewall or VLAN segmentation to trusted OT management hosts only, reducing the exploitable attack surface even while the SafeEnhancement feature remains enabled. Do not expose ADAM-3600 devices directly to untrusted networks or the internet. The NVD entry is available at https://nvd.nist.gov/vuln/detail/CVE-2026-43829 for tracking purposes.
More in Adam 3600 Edgelink
View allCommand injection in Advantech ADAM-3600 EdgeLink RTU controllers (versions prior to 2.8.5.1) lets remote attackers exec
Remote code execution via stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's Cookie parsing logic affects all
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge controllers is possible through a stack-based buff
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overf
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today