What is the CVSS score of CVE-2026-43830?

CVE-2026-43830 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Advantech ADAM-3600 are affected by CVE-2026-43830?

The Advantech ADAM-3600 EdgeLink RTU controller contains a critical command injection vulnerability (CVE-2026-43830, CVSS 9.8) allowing remote arbitrary command execution on affected industrial edge…

How to fix or mitigate CVE-2026-43830?

Within 24 hours: Inventory all Advantech ADAM-3600 EdgeLink RTU controllers in your environment, identify devices running versions prior to 2.8.5.1, and document their network accessibility and operational criticality. Within 7 days: Implement network-level access controls to restrict direct connectivity to affected controllers; disable or restrict the firmware upload functionality if operationally feasible; and enable enhanced logging and monitoring for any firmware upload attempts. Within 30 days: Monitor Advantech security advisories for availability of version 2.8.5.1 or later; develop and test an upgrade strategy in non-production environments; coordinate with operations to schedule patching during approved maintenance windows; and validate that security controls remain in place throughout the upgrade process.

Advantech ADAM-3600 CVE-2026-43830

EUVD-2026-51386 CRITICAL

Command Injection (CWE-77)

2026-07-31 CSA

GHSA-65r4-f2jx-xqqr

Command Injection Adam 3600 Edgelink Advantech

9.8

CVSS 3.1 · Vendor: CSA

Severity by source

Vendor (CSA) PRIMARY

9.8 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Firmware upgrade is inherently a privileged operation, so PR:H is more honest than PR:N absent confirmation the endpoint is truly unauthenticated; network-reachable, low-complexity, full impact otherwise.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CSA).

CVSS VectorVendor: CSA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 31, 2026 - 20:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 31, 2026 - 20:22 vuln.today

cvss_changed

Severity Changed

Jul 31, 2026 - 20:22 NVD

HIGH CRITICAL

CVSS changed

Jul 31, 2026 - 20:22 NVD

8.6 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 31, 2026 - 04:30 vuln.today

CVE Published

Jul 31, 2026 - 02:53 cve.org

HIGH 8.6

DescriptionCVE.org

Successful exploitation of the command injection vulnerability could allow an attacker to execute arbitrary commands during the firmware upgrade file verification process.

AnalysisAI

Command injection in Advantech ADAM-3600 EdgeLink RTU controllers (versions prior to 2.8.5.1) lets remote attackers execute arbitrary operating-system commands by abusing the firmware upgrade file verification routine. The device fails to sanitize input consumed while validating an uploaded firmware image, so crafted content is passed to a shell context. No public exploit identified at time of analysis, and the EPSS score is low (0.14%), but the CVSS 9.8 rating and the device's role as an industrial edge controller make this a high-value target.

Technical ContextAI

The ADAM-3600 EdgeLink is an Advantech intelligent RTU/edge-computing controller used in SCADA and industrial IoT deployments to bridge field sensors to upstream systems (CPE: cpe:2.3:a:advantech:adam-3600_edgelink). The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), specifically within the firmware upgrade file verification process. During this process the device evidently constructs a shell command incorporating attacker-influenced data (e.g., filename, metadata, or embedded content of the uploaded firmware package) without proper escaping or use of a safe exec API, allowing command separators or substitution syntax to break out of the intended command and run arbitrary OS commands, typically with the elevated privileges of the update service.

RemediationAI

Upgrade affected ADAM-3600 EdgeLink devices to version 2.8.5.1 or later, which is the first fixed release per the EUVD advisory. Until the update can be applied, do not expose the device's management or firmware-upgrade interface to untrusted networks: place the RTU behind a firewall or OT DMZ, restrict access to the upgrade endpoint to a dedicated management VLAN and known-good engineering workstations, and block inbound access to its web/management ports from general IT and internet-facing segments (side effect: remote administration must then be done through a jump host or VPN). Enforce network segmentation per IEC 62443 zones and disable or tightly control any remote firmware-push capability where operationally feasible. Consult the CSA advisory (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-097) for vendor-specific guidance before scheduling the maintenance window on production controllers.