Advantech ADAM-3600 EdgeLink remote terminal unit: 30 flaws (CVE-2026-43829 to CVE-2026-43858, up to CVSS 4.0 9.3) include unauthenticated command execution, authentication bypass and forged firmware uploads; update to EdgeLink 2.8.5.0

Advantech published a security advisory on 12 October 2026 for the ADAM-3600 EdgeLink, a remote terminal unit (RTU) used for industrial data acquisition and remote monitoring. It fixes 30 vulnerabilities, CVE-2026-43829 to CVE-2026-43858, found by Simone Bossi and Raffaele Bova of Nozomi Networks and coordinated with the Cyber Security Agency of Singapore (CSA), which issued alert AL-2026-149 on 20 October; Canada's Cyber Centre flagged the advisory the same day (AV26-1065). Every firmware version before EdgeLink 2.8.5.0 is affected. The most serious are rated critical under CVSS 4.0: CVE-2026-43836 (9.3) lets an attacker forge a packet to run arbitrary commands with maximum privileges, and CVE-2026-43844 (9.3) bypasses authentication in the device's proprietary protocol; CVE-2026-43845 (9.2) bypasses authentication through the password-reset mechanism; and stack buffer overflows in the log-message function (CVE-2026-43831, unauthenticated), the login function (CVE-2026-43838) and, when the SafeEnhancement feature is enabled, password and cookie parsing (CVE-2026-43829 and CVE-2026-43832, unauthenticated) can give code execution (all 9.2). Other fixes cover command injection while a firmware file is verified (CVE-2026-43830) and upload of a forged firmware image that could permanently compromise the device (CVE-2026-43835), unlimited brute-forcing of the administrator password over the proprietary protocol even with SafeEnhancement on (CVE-2026-43847), authenticated root-level command injection, arbitrary file read and file write, recovery of administrator credentials from an encrypted EdgeLink project file (CVE-2026-43854), and several unauthenticated crashes of the logging and licence-manager services. Advantech says EdgeLink 2.8.5.0 fixes all 30 and adds asymmetric digital signatures for firmware upgrades. Neither Advantech nor CSA reports exploitation. Primary: Advantech advisory (12 Oct); government: CSA AL-2026-149 (20 Oct).

Product

Advantech ADAM-3600 EdgeLink remote terminal unit (industrial data acquisition and remote monitoring)

Versions

Affected: ADAM-3600 EdgeLink firmware before 2.8.5.0. Fixed: EdgeLink 2.8.5.0.

CVSS

9.3 critical (CVSS 4.0, CVE-2026-43836 and CVE-2026-43844); five more at 9.2; 30 CVEs scored 6.3 to 9.3

Exploited in Australia?

unknown

Patch to

Update every ADAM-3600 to EdgeLink 2.8.5.0 from Advantech's official download page, and only from there, because several of the flaws sit in the firmware upgrade path itself. Make sure the RTU's web interface and EdgeLink protocol are not reachable from the internet or the corporate network, only from the OT management network, and alert on unexpected connections to them. After updating, change administrator passwords and treat EdgeLink project files as sensitive, since they can expose administrator credentials. See the ACSC's alert on protecting operational technology and edge devices (14 Oct 2026).

Primary: Advantech — Security advisory: Vulnerabilities identified in ADAM-3600 (v1.0, 12 Oct 2026; PDF) · Vendor: Advantech — Security advisories (ADAM-3600 EdgeLink 2.8.5.0) · CVE: CVE-2026-43829, CVE-2026-43858, CVE-2026-43836, CVE-2026-43844, CVE-2026-43845, CVE-2026-43831, CVE-2026-43838, CVE-2026-43832, CVE-2026-43830, CVE-2026-43835, CVE-2026-43847, CVE-2026-43854 · Cyber Security Agency of Singapore — AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities (20 Oct 2026); also Canadian Centre for Cyber Security AV26-1065 (20 Oct)

vulnerabilities ot ics network