Key points
- CVE-2026-43845 affects Advantech ADAM-3600 units running software versions older than 2.8.5.0.
- The National Vulnerability Database rates the issue as critical with a CVSS score of 9.2.
- Attackers can bypass authentication by exploiting weaknesses in the password reset mechanism.
Advantech ADAM-3600 devices running software versions prior to 2.8.5.0 are affected by a critical security flaw. The National Vulnerability Database identifies this issue as CVE-2026-43845. The vulnerability resides within the password reset mechanism of the device. This flaw allows an attacker to bypass the standard authentication process entirely. The source material does not confirm the availability of a patch.
In plain English
The ADAM-3600 is an industrial automation module. It uses a password reset feature that contains a significant weakness. An attacker can exploit this specific function to skip the login screen. They do not need to guess or steal a valid password. Instead, they manipulate the reset process to gain access. This effectively removes the security barrier protecting the device.
The background
The National Vulnerability Database assigns a CVSS score of 9.2 to this issue. This rating places the vulnerability in the critical severity range. The core problem is a failure in how the system handles credential changes. The description notes that the flaw allows authentication bypass. This means unauthorized users could potentially control the device.
What changes now
Users must verify their current software version immediately. If the version is older than 2.8.5.0, the system is vulnerable. The source material does not state that a fix exists. Users should check with Advantech for the latest status. Until a patch is confirmed, exposure remains high.
Who needs to act first
Teams should prioritize isolating exposed ADAM-3600 units from general networks. Check whether these devices communicate with critical production systems. If possible, restrict network access to trusted management stations only. Back up current configurations before making any changes. Monitor logs for unusual reset attempts or login activity. Consult vendor documentation for temporary mitigation steps. Do not assume the device is secure without verification.
What to do and how to stay safe
- Verify the software version on all ADAM-3600 units to confirm if they are below 2.8.5.0.
- Isolate affected devices from untrusted networks to limit potential attacker access.
- Monitor system logs for unauthorized password reset attempts or login anomalies.
- Contact Advantech support to inquire about the availability of a security update.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific version of the ADAM-3600 is vulnerable?
All versions prior to 2.8
