Advantech ADAM-3600 CVE-2026-43851

Exploitation requires an authenticated session with HIGH privileges on the Advantech ADAM-3600 (per PR:H in the CVSS vector) - an unauthenticated or low-privilege attacker cannot trigger it. Given valid high-privilege credentials, no user interaction and low attack complexity are needed, and the vector is network-reachable. The primary limiting factors are the need for elevated authentication and network access to the device's management/file interface; ADAM-3600 units are typically deployed on segmented OT networks, so reachability depends on network exposure. Impact is limited to reading files (confidentiality only); no write, code-execution, or availability impact is indicated.

This is a moderate-priority vulnerability whose signals are internally consistent but point to constrained real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 8.2) indicates a network-reachable, low-complexity attack requiring NO user interaction but HIGH privileges (PR:H) - meaning the attacker must already be authenticated with elevated/administrative access, which substantially raises the bar versus a pre-auth flaw. Impact is confidentiality-only (VC:H, VI:N, VA:N) with a subsequent-system confidentiality impact (SC:H), fitting a path-traversal file-read that can expose arbitrary files, potentially including credentials or configuration that extend compromise beyond the app. There is NO CISA KEV listing and NO public POC referenced, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was provided, so exploitation probability cannot be quantified - this is a gap, not evidence of low risk. The ADAM-3600 is an ICS/RTU edge controller, so although the raw score is High, the PR:H requirement plus the niche industrial footprint make this a targeted-risk issue rather than a mass-exploitation threat. CWE is listed as N/A, so the weakness class is only inferred from the description (CWE-22 path traversal).

An attacker who has already obtained authenticated, high-privilege access to the Advantech ADAM-3600 controller (e.g. via stolen operator credentials or a flat OT network) sends crafted requests containing directory-traversal sequences to a file-handling endpoint. The device returns the contents of arbitrary files outside the intended directory, exposing system configuration, credentials, or sensitive operational data. No public exploit code has been identified at time of analysis, and no user interaction is required.