EUVD-2026-51387
GHSA-x65g-869w-3ggw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, unauthenticated RCE grants full C/I/A impact; provided NVD vector's I:N/A:N is inconsistent with code execution and is assessed as erroneous.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
Lifecycle Timeline
6DescriptionCVE.org
Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a stack-based buffer overflow in the log message functionality to conduct code execution.
AnalysisAI
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge controllers is possible through a stack-based buffer overflow in the device's log message handling functionality, exploitable by unauthenticated network attackers on versions prior to 2.8.5.1. Reported by the Cyber Security Agency of Singapore (CSA), the vulnerability carries a CWE-121 classification - a well-understood root cause class with a history of weaponizable exploits, particularly in embedded and OT/ICS devices. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the network-accessible, unauthenticated nature of the flaw and the industrial deployment context elevate operational risk above what the percentile alone suggests.
Technical ContextAI
The Advantech ADAM-3600 EdgeLink is an industrial IoT edge controller (CPE: cpe:2.3:a:advantech:adam-3600_edgelink:*:*:*:*:*:*:*:*) designed for data acquisition and remote monitoring in OT/SCADA environments. The vulnerability is rooted in CWE-121 (Stack-based Buffer Overflow): the log message processing routine allocates a fixed-size stack buffer but fails to validate the length of attacker-controlled input before copying it, allowing adjacent stack memory - including the saved return address - to be overwritten. On embedded/industrial firmware where stack canaries, ASLR, or NX protections may be absent or weakened, this class of flaw is routinely exploitable to achieve arbitrary code execution. Because the log message path is network-exposed and requires no authentication, the attack surface is broad for any device reachable over the network.
RemediationAI
The primary remediation is to upgrade Advantech ADAM-3600 EdgeLink firmware to version 2.8.5.1 or later, as identified in the EUVD affected-versions data. The CSA advisory at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-097 should be consulted for vendor-specific upgrade procedures and any additional guidance. If immediate patching is not operationally feasible, defenders should enforce strict network segmentation to ensure the device is not reachable from untrusted networks or the internet - ADAM-3600 devices are OT edge controllers and should only be accessible from authorized engineering workstations or SCADA systems via allowlisted firewall rules. Blocking or rate-limiting access to log-related network services on the device, if configurable, is an additional compensating control, though its effectiveness depends on whether the vulnerable log path is separable from core device communication. Note that network segmentation prevents remote exploitation but does not eliminate insider or lateral-movement risk.
More in Adam 3600 Edgelink
View allCommand injection in Advantech ADAM-3600 EdgeLink RTU controllers (versions prior to 2.8.5.1) lets remote attackers exec
Remote code execution via stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's Cookie parsing logic affects all
Stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's password handling routine enables unauthenticated remote c
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overf
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today