EUVD-2026-51390
GHSA-r273-83r5-88cp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable upload endpoint (AV:N) but requires high-privilege auth (PR:H) and firmware-specific exploitation (AC:H); overflow yields full device code execution, so C/I/A all High, scope unchanged.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
Lifecycle Timeline
4DescriptionCVE.org
Successful exploitation of the vulnerability could allow an authenticated attacker to exploit a stack-based buffer overflow in the upload functionality to conduct code execution.
AnalysisAI
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overflow a fixed-size stack buffer in the device's file-upload functionality and execute arbitrary code on the controller. The flaw affects all versions listed in the CSA advisory (AL-2026-097) and, given the device's role in OT/SCADA data acquisition, a successful exploit yields full control of an industrial edge node. No public exploit has been identified at time of analysis, and high attack complexity plus a high-privilege requirement temper the network-facing CVSS 4.0 base score of 7.5.
Technical ContextAI
The ADAM-3600 EdgeLink is an Advantech industrial edge controller/RTU used to aggregate field sensor data and bridge OT networks to upstream systems (identified by cpe:2.3:a:advantech:adam-3600_edgelink). The root cause is a classic stack-based buffer overflow (CWE-121, although the input record lists CWE as N/A) in the product's upload handler: attacker-controlled data written into a fixed-size stack buffer without adequate bounds checking overwrites the saved return address and adjacent stack state. On embedded/OT devices these controllers typically run with weak memory protections (often no ASLR/stack canaries and code executing with elevated privilege), so a controlled overwrite in the upload routine translates directly into native code execution on the device.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to consult Advantech's product security advisory and the CSA alert (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-097) for updated firmware and apply it once released. Until a fixed firmware build is confirmed, apply compensating controls appropriate to OT: restrict network reachability of the ADAM-3600's management and upload interfaces to a dedicated management VLAN or jump host (removing broad network exposure directly counters the AV:N vector, at the cost of remote administration convenience); enforce strong, unique credentials and tightly limit who holds the high-privilege accounts needed to reach the upload feature (mitigates the PR:H prerequisite); and place the device behind an OT firewall that blocks the upload/management ports from untrusted zones. Each of these narrows the attack surface but does not remove the underlying overflow, so treat them as interim only and prioritize firmware upgrade once available.
More in Adam 3600 Edgelink
View allCommand injection in Advantech ADAM-3600 EdgeLink RTU controllers (versions prior to 2.8.5.1) lets remote attackers exec
Remote code execution via stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's Cookie parsing logic affects all
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge controllers is possible through a stack-based buff
Stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's password handling routine enables unauthenticated remote c
Share
External POC / Exploit Code
Leaving vuln.today