Advantech ADAM-3600 CVE-2026-43839

Exploitation requires network reachability to the ADAM-3600's logs management functionality; an attacker sends crafted input that triggers a NULL pointer dereference in that component. No authentication (PR:N) and no user interaction (UI:N) are required, and no special device configuration is named in the description. The primary limiting factor is network exposure: the ADAM-3600 is an industrial RTU/controller normally deployed on segmented OT/SCADA networks, so practical exploitation depends on the logs management service being reachable from an attacker-controlled network segment. Impact is limited to availability (service crash) - there is no path to code execution, data disclosure, or integrity compromise from this flaw alone.

The signals point to a moderate-to-serious availability risk, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 because it is remotely and trivially reachable by an unauthenticated attacker, but the impact is confined entirely to availability (VC:N/VI:N/VA:H) - a service crash with no confidentiality or integrity loss and no scope change. There is no CISA KEV listing, no public proof-of-concept, and no EPSS probability supplied in the input, so there is no evidence of active or imminent exploitation; the risk is theoretical potential rather than demonstrated abuse. The high base score is driven by ease of access, not by consequence severity: this is a denial-of-service against a single industrial device, so prioritization should be weighed against the operational criticality of the specific ADAM-3600 deployment rather than treated as a universal critical patch. Note the mismatch to flag for operators: the vector asserts AV:N (network) and PR:N (unauthenticated), yet ICS field devices like the ADAM-3600 are typically deployed on segmented OT networks - real-world reachability depends on network exposure that the CVSS vector cannot capture, so verify whether the logs management service is actually reachable from untrusted networks.

An attacker with network reachability to an exposed ADAM-3600 sends a crafted request to the logs management functionality that triggers a NULL pointer dereference, crashing the service without any authentication or user interaction. No public exploit code has been identified, but the low attack complexity means a working trigger would be straightforward to develop. In an OT environment this could interrupt monitoring or data acquisition for the affected RTU/controller.