Advantech ADAM-3600 CVE-2026-43838

Exploitation requires network access to the ADAM-3600's login interface, and the crafted overflow payload is processed during login handling so no valid credentials are needed (PR:N, UI:N). The key limiting factor is CVSS AC:H (high attack complexity): reliable code execution likely depends on conditions beyond the attacker's direct control - such as specific memory layout, firmware version, or defeating stack/memory protections - rather than being a guaranteed one-shot. The practical exposure is further constrained by whether the device's management/login service is reachable from untrusted networks; ADAM-3600 units segmented behind OT firewalls or not internet-exposed sharply reduce real-world attack surface. No non-default feature toggle is named in the description, so the login functionality is assumed present in standard deployments.

This is a genuinely high-priority flaw by severity signals: the vendor-assigned CVSS 4.0 base score is 9.2 (Critical) with a network attack vector (AV:N), no privileges (PR:N), and no user interaction (UI:N), and high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) - i.e. pre-authentication remote code execution on an Advantech ADAM-3600 industrial controller. The one tempering signal inside the vector is AC:H (high attack complexity), which indicates exploitation is not trivially reliable and likely depends on conditions outside the attacker's control (e.g. memory-layout/timing dependencies typical of stack overflow exploitation), modestly lowering real-world ease relative to the raw 9.2. Critically, several standard prioritization signals are ABSENT from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no indication of public POC/exploit code, so there is no evidence of active or at-scale exploitation. Note a potential tension to verify: CVSS declares PR:N (unauthenticated) yet the flaw is in 'login functionality' - this is consistent (the overflow is reachable while handling pre-auth login input), but defenders should confirm the login interface is exposed as modeled. Net assessment: treat as a high-priority patch target for anyone running ADAM-3600, driven by pre-auth RCE on OT hardware, while recognizing exploitation evidence is currently only theoretical (no KEV/EPSS/POC) and AC:H suggests any attacks would be targeted rather than mass/opportunistic.

An attacker with network reachability to an exposed ADAM-3600 management/login interface sends crafted input to the login function, overflowing a stack buffer to hijack control flow and execute attacker-supplied code on the controller - all without valid credentials (PR:N). Because the device is an industrial RTU/controller, successful exploitation yields a foothold in the OT environment with potential to manipulate or disrupt connected process logic. No public exploit code is identified at time of analysis, and the AC:H rating implies the attacker likely needs favorable conditions (e.g. defeating memory protections) for a reliable result.