Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Advantech ADAM-3600 EdgeLink – Multiple Vulnerabilities including Remote Code Execution, Authentication Bypass, and Sensitive Data Exfiltration

20 October 2026

Multiple vulnerabilities have been discovered in Advantech's ADAM-3600 EdgeLink remote terminal unit product. Advantech has released a security update to address these vulnerabilities. Special thanks to Advantech for coordinating the disclosure of these vulnerabilities with CSA.

Background

Advantech ADAM-3600 EdgeLink is a remote terminal unit product designed for industrial data acquisition and remote monitoring.


CVE ID – Description

CVE-2026-43829 | 9.2 (Critical) A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.

CVE-2026-43830 | 8.6 (High) A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.

CVE-2026-43831 | 9.2 (Critical) A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution.

CVE-2026-43832 | 9.2 (Critical) A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled.

CVE-2026-43833 | 7.5 (High) A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution.

CVE-2026-43834 | 7.5 (High) A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.

CVE-2026-43835 | 8.6 (High) A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.

CVE-2026-43836 | 9.3 (Critical) A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.

CVE-2026-43837 | 7.5 (High) A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.

CVE-2026-43838 | 9.2 (Critical) A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.

CVE-2026-43839 | 8.7 (High) A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.

CVE-2026-43840 | 6.9 (Medium) A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.

CVE-2026-43841 | 6.9 (Medium) A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.

CVE-2026-43842 | 6.9 (Medium) A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.

CVE-2026-43843 | 6.9 (Medium) An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.

CVE-2026-43844 | 9.3 (Critical) A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.

CVE-2026-43845 | 9.2 (Critical) A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.

CVE-2026-43846 | 8.6 (High) A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.

CVE-2026-43847 | 8.2 (High) A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.

CVE-2026-43848 | 6.9 (Medium) A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.

CVE-2026-43849 | 6.9 (Medium) A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.

CVE-2026-43850 | 8.6 (High) A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.

CVE-2026-43851 | 8.2 (High) A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.

CVE-2026-43852 | 8.2 (High) A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.

CVE-2026-43853 | 8.2 (High) A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.

CVE-2026-43854 | 6.3 (Medium) A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.

CVE-2026-43855 | 7.5 (High) A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

CVE-2026-43856 | 8.6 (High) A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.

CVE-2026-43857 | 8.6 (High) A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.

CVE-2026-43858 | 8.6 (High) A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.


Affected Versions

Advantech ADAM-3600 EdgeLink prior to version 2.8.5.0


Mitigation

Advantech has released a security update to address these vulnerabilities. Users and administrators of affected product versions are advised to update to the latest version immediately.


Timeline

  • 2026-04-29 – Vendor Disclosure

  • 2026-10-15 – Vendor Patched

  • 2026-10-20 – Public Release


References
https://www.advantech.com/en/security-advisory (opens in new tab)