Loading story…
Advantech has patched 30 vulnerabilities affecting ADAM-3600 EdgeLink versions earlier than 2.8.5.0, an industrial remote terminal unit product used for data acquisition and remote monitoring. Singapore’s Cyber Security Agency reported that the flaws could enable code execution, authentication bypass, credential retrieval, sensitive-data disclosure, arbitrary file access or modification, and service crashes. Several flaws are exploitable without authentication; the highest reported severity score is 9.3, covering maximum-privilege command execution and proprietary-protocol authentication bypass.
Associated vulnerability records include root-level command injection (CVE-2026-43850), arbitrary file reads and writes (CVE-2026-43851 and CVE-2026-43852), an unauthenticated service crash via a crafted message (CVE-2026-43853), and authenticated code-execution flaws (CVE-2026-43856 through CVE-2026-43858). Most of these listed code-execution and file-access flaws require high privileges. Advantech released patches on October 15, ahead of public disclosure on October 20, and Singapore’s agency urges affected users to update immediately. Canada’s Cyber Centre also advises reviewing the vendor guidance and applying necessary updates. The supplied advisories do not report observed exploitation.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-1065 identifying ADAM-3600 versions before 2.8.5.0 as affected. It directed users and administrators to Advantech's advisories and recommended applying necessary updates.
The vulnerabilities were publicly released, with Singapore's Cyber Security Agency detailing CVE-2026-43829 through CVE-2026-43858 and urging affected users to update immediately. The highest severity score was 9.3, covering maximum-privilege command execution and proprietary-protocol authentication bypass.
Advantech released a security update addressing 30 vulnerabilities affecting ADAM-3600 EdgeLink versions before 2.8.5.0. The flaws could enable code execution, authentication bypass, sensitive-data disclosure, arbitrary file access or modification, and service crashes.
The disclosure timeline in Singapore's Cyber Security Agency advisory records vendor disclosure of the ADAM-3600 EdgeLink vulnerabilities on April 29, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
12 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecirt.gy
Open sourcecsa.gov.sg
Open sourceadvcloudfiles.advantech.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Advantech WebAccess/SCADA has been found to contain several critical vulnerabilities, including an unrestricted file upload flaw (CVE-2025-14849) and a directory traversal vulnerability (CVE-2025-14850). The unrestricted file upload issue could allow a remote attacker to execute arbitrary code on affected systems, while the directory traversal flaw may enable attackers to delete arbitrary files. Both vulnerabilities are remotely exploitable and have been assigned high CVSS scores, indicating significant risk to organizations using this software in critical infrastructure sectors. CISA has issued an advisory confirming that these vulnerabilities affect Advantech WebAccess/SCADA version 9.2.1, and recommends updating to version 9.2.2 to mitigate the risks. The vulnerabilities impact organizations in sectors such as critical manufacturing, energy, and water and wastewater, with deployments worldwide. Exploitation of these flaws could allow authenticated attackers to read or modify remote databases, potentially leading to severe operational disruptions.
Dec 18, 2025
Advantech released security updates for **EKI-series industrial wireless access points** after researchers disclosed **20 vulnerabilities**, including **six critical flaws** tracked as `CVE-2024-50370` through `CVE-2024-50375`. The most severe issues affect over-the-air functionality and can let a **remote, unauthenticated attacker** bypass authentication, execute arbitrary code as **root**, and take full control of exposed devices. The affected products are **EKI-6333AC-2G** and **EKI-6333AC-2GD** running firmware earlier than **v1.6.5**, and **EKI-6333AC-1GPO** running firmware earlier than **v1.2.2**. Additional high-severity weaknesses could enable **cross-site scripting**, **system command injection**, **denial of service**, and unauthorized access to sensitive data. Defenders are advised to **immediately upgrade firmware** to the vendor-fixed versions and review internet-exposed or operational technology deployments using these access points.
Nov 29, 2024
The Canadian Centre for Cyber Security issued advisory **AV26-937** for vulnerabilities affecting Advantech **EKI-1242EIMS** and **EKI-1242IEIMS** industrial-control products running firmware **2.00.01 or earlier**. The advisory directs operators and administrators to review Advantech’s security guidance and apply vendor updates when available. The available advisory information does not identify CVE identifiers, severity scores, technical impacts, or evidence of active exploitation. Organizations using the affected devices should inventory deployed firmware versions, monitor Advantech’s security-advisory channel for remediation details, and prioritize updates under established industrial-control-system change-management procedures.
Sep 18, 2026