Advantech ADAM-3600 CVE-2026-43835

Exploitation requires the attacker to already hold privileged/authenticated access to the ADAM-3600's firmware upgrade functionality (CVSS PR:H) and to supply a forged firmware upgrade file that the device accepts due to insufficient firmware authenticity/signature validation. The limiting factor is this high-privilege authentication requirement - an unauthenticated or low-privilege actor cannot reach the upgrade function - while there is no user-interaction requirement (UI:N) and the attack is network-reachable (AV:N). Real-world exposure therefore depends on whether the device's management interface is network-accessible and on the strength of its privileged credentials.

The CVSS 4.0 base score of 8.6 (HIGH) reflects network attack vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and high confidentiality/integrity/availability impact to the vulnerable system (VC:H/VI:H/VA:H), but critically requires high privileges (PR:H) - meaning the attacker must already be an authenticated, privileged user before exploitation. This privilege barrier substantially lowers real-world risk relative to the raw score: it is not a remote unauthenticated takeover but a post-authentication abuse of the firmware upgrade feature. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation; the absence of these signals suggests this is currently a prioritized-by-severity item rather than a demonstrably exploited one. Note a data conflict: the sole tag is 'Information Disclosure,' yet the description and the VI:H/VA:H impact point to integrity/availability compromise (malicious firmware persistence), not primarily disclosure - the tag appears mislabeled. Treat this as a meaningful priority for exposed/privileged-access ICS deployments but not a drop-everything emergency absent exploitation evidence.

An attacker who has already obtained privileged/administrative credentials to an Advantech ADAM-3600 controller (e.g., via reused, default, or stolen credentials) crafts a forged firmware upgrade image and submits it through the device's firmware upgrade function. Because the device fails to properly validate firmware authenticity, it accepts and flashes the malicious image, giving the attacker persistent, device-level control that can survive reboots and resist remediation. No public exploit code is identified at time of analysis, and the attack requires prior high-privilege authentication (PR:H).