Advantech ADAM-3600 CVE-2026-43849

Exploitation requires network reachability to the vulnerable ADAM-3600 service; per the supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed against a reachable device. The description does not name the specific feature, protocol, or interface that triggers the heap read, so the exact exposed endpoint must be confirmed from the Advantech advisory. Practical limiting factor: as an OT/ICS field RTU, the device is typically deployed behind ICS network segmentation and should not be internet-facing, so realistic exploitation depends on the attacker first gaining access to the operational network segment or to an improperly exposed management interface. Impact is limited to disclosure of memory contents (low confidentiality); no integrity or availability effect applies.

This is a moderate-severity information disclosure flaw (CVSS 4.0 base 6.9) in the Advantech ADAM-3600 industrial RTU. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, which on paper makes it easy to trigger; however, impact is bounded to low confidentiality only (VC:L, with VI:N/VA:N), reflecting a heap over-read that leaks sensitive memory contents rather than enabling code execution or data tampering. No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no evidence of active or imminent widespread exploitation. The practical risk is driven less by exploitation probability and more by exposure context: ADAM-3600 units are OT/ICS field controllers that should not be internet-facing, so the AV:N rating assumes network reachability that, in a properly segmented ICS network, is often absent - real-world risk therefore hinges on whether the device management interface is exposed. Net assessment: a credible but not urgent priority - patch during normal OT maintenance windows, prioritizing any units reachable from untrusted networks. Conflicting signal to verify: the description does not specify which service or protocol exposes the heap read, so the AV:N assumption should be confirmed against the actual network exposure of deployed units.

An attacker with network access to an exposed ADAM-3600 management or protocol interface sends a crafted request that triggers an out-of-bounds heap read, causing the device to return adjacent memory contents in its response. Repeated requests allow the attacker to harvest sensitive data such as credentials, configuration, or process values from device memory. No public exploit code was identified at time of analysis.