Advantech ADAM-3600 CVE-2026-43850

Exploitation requires the attacker to already be an authenticated, high-privilege user of the Advantech ADAM-3600 (CVSS PR:H), so this is not reachable by anonymous remote attackers against a default/unauthenticated state. The flaw is a command injection in the device's command-handling functionality, letting an authenticated user escape intended input constraints to run arbitrary OS commands as root; no additional user interaction is required (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). The principal limiting factors are the need for valid privileged credentials/session on the controller and the device's typical placement inside segmented OT/ICS networks rather than on the public internet; the exact vulnerable interface and affected firmware versions were not specified in the provided data.

This is a genuinely serious flaw in an industrial edge gateway, but several signals temper its urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 8.6 and reflects full compromise of the vulnerable system (confidentiality, integrity, availability all High) reachable over the network with low complexity, consistent with the description of root-level code execution via command injection. The critical mitigating factor is PR:H: the attacker must already hold high privileges on the device, so this is a privilege-escalation / post-authentication RCE rather than a pre-auth internet-facing takeover. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent widespread exploitation - it is not confirmed actively exploited (not in CISA KEV) and no public exploit identified at time of analysis. For ICS/OT environments where the ADAM-3600 controls physical processes, the High integrity and availability impact makes patching important despite the privilege prerequisite, as an attacker who has already obtained an operator/admin foothold could pivot to full root control. Note the SSVC/automatable fields and technical-impact decision inputs were not supplied, so exploitation-maturity cannot be formally graded. Overall: high technical severity but realistic risk is bounded by the authentication requirement and the niche ICS deployment footprint.

An attacker who has already obtained authenticated access to an Advantech ADAM-3600 RTU (for example via stolen operator credentials or a prior foothold on the OT network) submits crafted input into a vulnerable command-handling interface, injecting shell commands that execute with root privileges. This yields complete control of the controller, allowing manipulation of monitored/controlled physical processes. No public exploit code was identified in the provided data, so any current exploitation would require custom tooling.