Advantech ADAM-3600 CVE-2026-43853

Exploitation requires network reachability to the ADAM-3600's affected service and the ability to deliver a crafted message that triggers the assertion fault; the CVSS 4.0 AT:P metric indicates a specific precondition must hold for the fault to fire, so success is not guaranteed against every configuration or state. No authentication and no user interaction are required (PR:N/UI:N). The practical limiting factor is exposure: the controller must be reachable from the attacker (directly or via an OT network path), which in properly segmented industrial environments should not be from untrusted networks. Impact is confined to availability (service crash) with no confidentiality or integrity effect.

This is a network-exploitable, unauthenticated denial-of-service flaw in the Advantech ADAM-3600 industrial RTU/edge controller. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms a remote attacker needs no privileges and no user interaction, but the AT:P flag (attack requirement present) signals that a specific precondition or state must exist for the crafted message to trigger the assertion fault - exploitation is therefore not fully deterministic against every default instance. Impact is availability-only (VC:N/VI:N/VA:H): no data disclosure or integrity loss, just a service crash. The 8.2 (HIGH) score is driven almost entirely by the availability impact of an internet-reachable OT device; in an ICS context a crashing RTU can be operationally serious. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active or probable near-term exploitation - this looks like a genuine HIGH-severity availability issue rather than a mass-exploited threat, with real-world urgency hinging on whether the device is network-exposed. Note the CVSS 4.0 score and SSVC-style signals (automatable/exploitation status) were not supplied, so the exploitation-likelihood dimension is unverified.

An attacker with network reachability to an exposed ADAM-3600 controller sends a specially crafted protocol message that triggers an assertion fault in the handling service, causing it to crash and interrupting monitoring/control functions. Because the CVSS vector is AV:N/PR:N/UI:N, no authentication or user interaction is required, though the AT:P flag indicates a specific condition must be met for the fault to fire. No public exploit code was identified in the provided data.