SINGAPORE’S Cyber Security Agency disclosed 30 vulnerabilities affecting Advantech ADAM-3600 industrial remote terminal units (RTUs) on 20 October 2026. The devices are used for industrial data collection and remote monitoring, including at utilities and factories. The flaws affect all EdgeLink versions before 2.8.5.0; Advantech released a fix on 15 October. The report classifies eight vulnerabilities as critical, 15 as high and seven as medium, with CVSS scores reaching 9.8 for CVE-2026-43830.
Several flaws could allow remote code execution or bypass authentication. A forged packet exploiting CVE-2026-43836 can reportedly run commands with maximum privileges, while CVE-2026-43844 bypasses authentication in the proprietary protocol and CVE-2026-43845 combines a password-reset weakness with login bypass. Four buffer overflows affect password, log, cookie and login functions; most reportedly require no authentication.
Other issues include command injection, forged firmware uploads, path traversal and arbitrary file writes. The article notes that two critical overflows apply only when SafeEnhancement is enabled, while a brute-force flaw works even with that feature enabled.
No exploitation in the wild or public proof-of-concept has been confirmed, and the flaws are not listed in CISA’s KEV catalogue. The vulnerabilities were reported by Simone Bossi and Raffaele Bova of Nozomi Networks, according to the CVE records. Administrators should update EdgeLink to version 2.8.5.0 or later. The CSA also advises keeping RTUs off the internet and limiting access to the proprietary protocol and web interface to trusted hosts.