EUVD-2026-104849
GHSA-v54g-3wcx-8jj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ADAM-3600 over network
-
ExploitSend crafted bulk port configuration request
-
ExecutionTrigger fault in configuration handler
-
ImpactCrash service and disrupt device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the device's bulk port configuration feature on the Advantech ADAM-3600; an attacker must have network reachability to this configuration service to send the crafting-triggering request. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special attack requirements are needed, so default-reachable configurations are exploitable. The practical limiting factor is network exposure: ADAM-3600 units deployed behind proper ICS/OT network segmentation and not exposed to untrusted networks substantially reduce reachability, and the impact is limited to service crash (availability) with no confidentiality or integrity effect. |
| Impact | This is a moderate-risk availability-only vulnerability, not a top-tier priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, but the impact is confined to availability at a low level (VA:L) with no confidentiality or integrity impact (VC:N/VI:N) - consistent with a service crash rather than code execution or data exposure. No EPSS score, CISA KEV listing, or POC availability was supplied in the input, so there is no signal of active or probable exploitation to elevate urgency. No SSVC decision data was provided. The real-world risk is tempered by the affected product: the Advantech ADAM-3600 is a niche industrial RTU/gateway (OT/ICS) device, so exposure depends heavily on whether such devices are reachable from untrusted networks - which, in well-segmented ICS environments, they should not be. The score of 6.9 is driven by the easy remote reachability rather than severe impact; treat it as a patch-when-practical availability issue, prioritized higher only for internet-exposed or poorly segmented deployments. |
| Exploit ScenarioDerived | An attacker with network reachability to an exposed ADAM-3600 device sends a crafted request to the bulk port configuration functionality, triggering a fault that crashes the service and disrupts the device's operation. No authentication or user interaction is required per the CVSS vector. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Unauthenticated remote attackers can crash the bulk port configuration service on Advantech ADAM-3600 edge controllers, causing a limited denial-of-service condition with no confidentiality or integrity impact. The flaw is network-reachable and requires no user interaction, but practical risk depends on whether the device's configuration service is exposed beyond properly segmented ICS/OT networks. No public exploit code has been identified at time of analysis, and the issue is availability-only rather than remote code execution.
RemediationAI
No vendor-released patch version is identified in the provided data, so remediation should begin with confirming fixed firmware availability through Advantech's security advisory and applying it once published; consult the CSA alert for regional guidance. Until then, block network access to the bulk port configuration service at perimeter firewalls and ICS/OT conduits, restrict management access to trusted engineering VLANs or jump hosts, and disable the bulk configuration feature where operationally feasible. These controls can interrupt remote provisioning and centralized configuration workflows, so validate them in a lab and document exceptions. Monitor ADAM-3600 logs and service-restart events for repeated crashes that may indicate attempted exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ADAM-3600 is an industrial edge controller/RTU used in OT environments; the affected functionality is the bulk port configuration service that accepts configuration requests over the network. Because CWE data was not provided, the root cause can only be characterized as improper handling of crafted bulk configuration input that terminates or destabilizes the service process. The CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N with VA:L confirms network reachability, no authentication, no user interaction, and availability-only impact; the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is consistent. Exploitability is constrained mainly by network exposure: devices behind ICS/OT segmentation and management ACLs are substantially harder to reach.
Know when Adam 3600 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote unauthenticated crash of a reachable configuration service gives AV:N/AC:L/PR:N/UI:N; impact is a service crash only, so C:N/I:N and A:L with scope unchanged.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
DescriptionCVE.org
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Forged network packets sent to the Advantech ADAM-3600 remote terminal unit (RTU) can trigger arbitrary command executio
Authentication bypass in Advantech ADAM-3600 remote terminal units allows unauthenticated network attackers to bypass th
Authentication bypass in Advantech ADAM-3600 enables unauthenticated network attackers to abuse the password-reset mecha
Unauthenticated remote code execution is possible against the Advantech ADAM-3600 through a stack-based buffer overflow
Authenticated, high-privilege users of the Advantech ADAM-3600 industrial edge gateway can exploit a command injection f
Unauthenticated remote attackers can crash the logs management service on Advantech ADAM-3600 industrial RTUs/controller
Stack-based buffer overflow in Advantech ADAM-3600 can let a remote attacker with administrative credentials execute arb
Stack-based buffer overflow in Advantech ADAM-3600's FileProcess::CheckDir path handling lets an authenticated attacker
Arbitrary code execution on Advantech ADAM-3600 devices is possible for remote attackers who already possess high-privil
Stack-based buffer overflow in Advantech ADAM-3600 industrial remote I/O modules lets a high-privileged authenticated at
A privileged, authenticated attacker who can reach the Advantech ADAM-3600 firmware upgrade function can upload a forged
The Advantech ADAM-3600 industrial RTU/edge controller can be crashed by a remotely delivered crafted message that trigg
Exploit-DB