Advantech ADAM-3600 CVE-2026-43843

Exploitation requires network reachability to the ADAM-3600's license manager service; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are needed, so exposed default deployments are reachable. The primary limiting factor is exposure scope: as an industrial RTU, the device is often deployed on segmented OT/field networks rather than directly on the internet, so realistic reach typically depends on the attacker already being on a connected control network or a poorly segmented environment. Impact is limited to a service crash (availability); there is no confidentiality or integrity effect.

This is a low-to-moderate priority issue despite its network-exploitable, unauthenticated nature. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable flaw - remote, no authentication, no user interaction, low complexity - but the impact is confined to availability only (VC:N/VI:N/VA:L), consistent with a service crash rather than code execution or data compromise. The 6.9 score is therefore driven by ease of access, not by severity of outcome. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; the status is best described as no public exploit identified at time of analysis. The key tempering factor is that this affects the Advantech ADAM-3600, an industrial RTU/controller - availability loss on such OT equipment can be operationally significant (loss of monitoring/control), which raises its practical weight above a typical IT DoS even though the raw impact metric is low. Verify with the Advantech advisory whether the crash is persistent (requiring manual restart) versus transient, as this materially changes real-world risk.

An attacker with network reachability to the ADAM-3600's license manager service sends a crafted request whose values trigger an integer overflow, causing the service to crash and become unavailable. No authentication or user interaction is required, so any actor able to route packets to the exposed service port can repeatedly induce denial of service. No public proof-of-concept was identified in the provided data.