EUVD-2026-104857
GHSA-h92j-34q3-g4mj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with high privileges to ADAM-3600
-
DeliverySubmit path longer than 1024 bytes
-
ExploitOverflow stack buffer in FileProcess::CheckDir
-
ExecutionOverwrite return address
-
ImpactExecute arbitrary code on controller
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold HIGH-privilege authenticated access to the Advantech ADAM-3600 device (PR:H), and to reach the code path that calls FileProcess::CheckDir with a user-controlled directory path. The concrete trigger is supplying a path longer than 1024 bytes, which overflows a fixed-size stack buffer. Limiting factors: the high-privilege authentication requirement is the primary constraint - this is not exploitable by anonymous or low-privilege remote users; no user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L) once authenticated. Impact is confined to the vulnerable device itself (SC:N/SI:N/SA:N - no scope change). |
| Impact | This is a credible but conditional risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 8.6) indicates a network-reachable, low-complexity flaw with full compromise of the vulnerable system (VC:H/VI:H/VA:H), but it explicitly requires HIGH privileges (PR:H) - the attacker must already be an authenticated, high-privilege user on the ADAM-3600 device. That precondition substantially lowers real-world severity versus an unauthenticated RCE. No EPSS score, CISA KEV listing, or POC indicator was supplied in the input, so there is no evidence of active exploitation or published exploit code at time of analysis. SSVC-style reasoning: technical impact is Total, but exploitation status is None and automatability is limited by the authentication requirement, so this reads as a serious-but-not-emergency patch priority for operators of the specific device rather than a broadly wormable threat. One signal to verify: the description says 'remote authenticated attacker' which is consistent with the PR:H vector, so no contradiction exists between the text and the CVSS auth metric. |
| Exploit ScenarioDerived | An attacker who has already obtained high-privilege authenticated access to an Advantech ADAM-3600 controller (e.g., stolen operator/admin credentials or an insider) sends a crafted request to a function that invokes FileProcess::CheckDir with a directory path exceeding 1024 bytes. The oversized path overflows a fixed stack buffer, overwriting the return address and allowing execution of arbitrary code on the device. No public proof-of-concept was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Stack-based buffer overflow in Advantech ADAM-3600's FileProcess::CheckDir path handling lets an authenticated attacker with high-privilege access supply a directory path longer than 1024 bytes and potentially achieve arbitrary code execution on the device. The flaw is network-reachable with low complexity and no user interaction once the attacker holds the required high-privilege credentials, but impact is confined to the device with no scope change. No public exploit was identified at the time of analysis, and exploitation is primarily constrained by the high-privilege authentication prerequisite.
RemediationAI
Patch status: Patch available per vendor advisory; no exact fixed firmware version is specified in the provided data. Apply the fixed firmware release identified in Advantech's security advisory (https://www.advantech.com/en/security-advisory) and cross-check the CSA alert AL-2026-149 (https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149) to confirm the correct build for each ADAM-3600 deployment. Because exploitation requires high-privilege authenticated access, reduce the attack surface by restricting network access to the device's administrative and file-processing interfaces to trusted management VLANs or jump hosts, disabling unused remote services, and reviewing high-privilege accounts for necessity and credential hygiene. These controls carry operational trade-offs: network segmentation can complicate remote maintenance and SCADA polling, and account reduction may disrupt automated integrations, so stage changes against the device's operational requirements. Continue monitoring vendor advisories and CSA updates for a version-specific patch or interim mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Advantech ADAM-3600 is an industrial edge controller/remote I/O device. The vulnerable code path is FileProcess::CheckDir, which handles a caller-supplied directory path in a fixed-size 1024-byte stack buffer without adequate bounds checking; a longer path overwrites stack memory and can redirect execution. This is a classic stack-based buffer overflow in path-handling logic. The supplied CPE cpe:2.3:a:advantech:adam-3600:*:*:*:*:*:*:*:* covers ADAM-3600 without a version restriction in the available data. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) agree that the attacker must already hold high privileges, that no user action is required, and that the impact does not cross a security scope boundary. The primary limitation is the need for high-privilege authenticated access to invoke the vulnerable directory-handling function with an oversized path, not network reachability or attack complexity.
Know when Adam 3600 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable (AV:N) and low-complexity (AC:L) but requires high-privilege authentication (PR:H); arbitrary code execution yields full C/I/A impact with no scope change.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
DescriptionCVE.org
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
Executive ViewAI
Advantech ADAM-3600 industrial controllers contain a high-severity stack buffer overflow that could let a high-privilege user execute arbitrary code on the device. The flaw is network-reachable but constrained by the need for high-privilege credentials, and no public exploit identified at time of analysis; impact is confined to the device with no scope change. Leadership should care because these devices often sit in OT environments where availability and integrity matter, and no vendor-released patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to the ADAM-3600 management interface via firewall/ACL, enforce strong credentials and least privilege for high-privilege accounts, monitor for abnormally long directory-path inputs, segment devices on an OT VLAN, and apply any vendor-provided workarounds per advisory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Forged network packets sent to the Advantech ADAM-3600 remote terminal unit (RTU) can trigger arbitrary command executio
Authentication bypass in Advantech ADAM-3600 remote terminal units allows unauthenticated network attackers to bypass th
Authentication bypass in Advantech ADAM-3600 enables unauthenticated network attackers to abuse the password-reset mecha
Unauthenticated remote code execution is possible against the Advantech ADAM-3600 through a stack-based buffer overflow
Authenticated, high-privilege users of the Advantech ADAM-3600 industrial edge gateway can exploit a command injection f
Unauthenticated remote attackers can crash the logs management service on Advantech ADAM-3600 industrial RTUs/controller
Stack-based buffer overflow in Advantech ADAM-3600 can let a remote attacker with administrative credentials execute arb
Arbitrary code execution on Advantech ADAM-3600 devices is possible for remote attackers who already possess high-privil
Stack-based buffer overflow in Advantech ADAM-3600 industrial remote I/O modules lets a high-privileged authenticated at
A privileged, authenticated attacker who can reach the Advantech ADAM-3600 firmware upgrade function can upload a forged
The Advantech ADAM-3600 industrial RTU/edge controller can be crashed by a remotely delivered crafted message that trigg
Arbitrary file write in Advantech ADAM-3600 lets an authenticated attacker with high-privilege operator or administrator
Exploit-DB