Advantech ADAM-3600 CVE-2026-43845

Exploitation targets the ADAM-3600's password-reset mechanism and, per the CVSS 4.0 AT:P metric, requires a specific attack precondition to be met in that reset flow rather than being unconditionally exploitable - the input description does not specify the exact trigger (e.g., a predictable or interceptable reset token, a particular device/configuration state, or a timing condition), so this must be confirmed against the Advantech advisory. Reachability requires network access to the controller's management/reset interface; in typical OT deployments these devices should sit on isolated/segmented networks, so exposure depends on whether the device is internet-facing or reachable from a compromised IT segment. No valid authentication is required (PR:N) and no user interaction is needed (UI:N).

This is a genuine high priority for affected ICS/OT environments, though several signals require caveats. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H/VA:H) scores 9.2 CRITICAL and describes a network-reachable, unauthenticated authentication bypass with total confidentiality, integrity, and availability impact on the vulnerable system - a near worst-case profile for a controller. The one tempering metric is AT:P (Attack Requirements: Present), meaning successful exploitation depends on a specific condition in the password-reset flow rather than being fire-and-forget, which is why the score is 9.2 rather than ~10.0. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - the elevated risk is driven by severity and reachability, not by observed in-the-wild activity. The main data gap is the description itself: 'a vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism' names no concrete trigger, and CWE is N/A, so the exact AT:P precondition cannot be confirmed from the input and should be verified against the Advantech advisory. No SSVC decision data was provided.

An attacker with network access to an exposed Advantech ADAM-3600 controller abuses a flaw in the password-reset workflow to take over or authenticate as a privileged account without valid credentials, gaining full control of the RTU. Because AT:P applies, the attacker must satisfy a specific condition in the reset process (e.g., a predictable/leaked reset token or a particular device state) rather than exploiting unconditionally. No public exploit code was identified at the time of analysis.