EUVD-2026-51389
GHSA-q9wm-fmhh-v7p9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Stack-based buffer overflow enabling code execution implies full C/I/A impact; PR:N confirmed by description; SafeEnhancement condition does not raise AC given AC:L in source vector.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
Lifecycle Timeline
6DescriptionCVE.org
Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a stack-based buffer overflow in the Cookie parsing methods to conduct code execution when the SafeEnhancement feature is enabled.
AnalysisAI
Remote code execution via stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's Cookie parsing logic affects all firmware versions prior to 2.8.5.1, exploitable by unauthenticated network attackers when the SafeEnhancement feature is enabled. The vulnerability (CWE-121) allows arbitrary code execution on the edge controller, an OT/IIoT device typically deployed in industrial automation environments. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the industrial attack surface warrants heightened concern due to the operational consequences of device compromise. Notably, the provided CVSS vector (C:H/I:N/A:N) is inconsistent with the described code execution impact - a discrepancy that should be verified with the vendor.
Technical ContextAI
The Advantech ADAM-3600 EdgeLink is an industrial IoT edge controller used in SCADA and automation environments, identified by CPE cpe:2.3:a:advantech:adam-3600_edgelink:*:*:*:*:*:*:*:*. The vulnerability is a CWE-121 (Stack-based Buffer Overflow) located in the HTTP Cookie parsing methods of the device's web interface or communication stack. Stack-based overflows of this class occur when attacker-controlled input exceeds a fixed-size stack buffer without bounds checking, allowing overwrite of return addresses or saved frame pointers and redirecting execution flow. The exploitation path is conditioned on the 'SafeEnhancement' feature being enabled - the exact nature of this feature (whether it is a security mode or a functional capability) is not detailed in available advisories but represents a configuration prerequisite. The advisory was published by the Cyber Security Agency of Singapore (CSA) under alert AL-2026-097, and the vulnerability is also tracked as ENISA EUVD-2026-51389.
RemediationAI
Upgrade Advantech ADAM-3600 EdgeLink firmware to version 2.8.5.1 or later, which is the vendor-confirmed fix version per EUVD-2026-51389. The CSA advisory at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-097 should be consulted for official upgrade guidance and any additional vendor-supplied instructions. As an immediate compensating control where patching is not immediately feasible, disable the SafeEnhancement feature if it is not operationally required - this removes the prerequisite condition for exploitation and eliminates the attack path, though the trade-off is the loss of whatever functionality SafeEnhancement provides (nature of trade-off should be assessed with the site engineer). Additionally, restrict network access to the device's web or communication interface via firewall rules or network segmentation, ensuring only authorized management hosts can reach the device. Air-gapping or placing the device behind an OT DMZ reduces exposure to unauthenticated network attackers.
More in Adam 3600 Edgelink
View allCommand injection in Advantech ADAM-3600 EdgeLink RTU controllers (versions prior to 2.8.5.1) lets remote attackers exec
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge controllers is possible through a stack-based buff
Stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's password handling routine enables unauthenticated remote c
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overf
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today