Advantech ADAM-3600 Password Reset Flaw Allows Auth Bypass
A critical CVE-2026-43845 vulnerability in Advantech ADAM-3600 firmware prior to version 2.8.5.0 allows attackers to bypass authentication.
Key points
- The flaw is rated CVSS 9.2 Critical by the National Vulnerability Database.
- It affects Advantech ADAM-3600 units running firmware versions earlier than 2.8.5.0.
- Attackers can exploit the password reset mechanism to bypass authentication controls.
Advantech ADAM-3600 industrial modules contain a critical authentication bypass vulnerability that allows attackers to circumvent login protections. The National Vulnerability Database records this flaw as CVE-2026-43845, assigning it a high severity score of 9.2.
At a glance
- CVE
- CVE-2026-43845
- Product
- Advantech ADAM-3600
- CVSS
- 9.2 Critical
- Weakness
- —
- Exploited
- No known exploitation
The vulnerability resides specifically within the password reset mechanism of the device firmware. An attacker who can send crafted requests to this function can bypass the authentication process entirely. This enables unauthorized access to the system without needing valid credentials or exploiting other entry points.
Context and Background
This discovery adds to a series of serious security findings for this specific hardware line. Threat Times previously reported on October 20, 2026, that older Advantech ADAM-3600 firmware contained a critical remote code execution flaw triggered by forged packets.
That earlier reporting also highlighted a critical stack-based buffer overflow in the login feature of the same units. The combination of these vulnerabilities suggests that unpatched ADAM-3600 systems face multiple vectors for compromise, ranging from arbitrary command execution to direct authentication bypass.
Who Is Affected
The vulnerability impacts Advantech ADAM-3600 devices running firmware versions prior to 2.8.5.0. Organizations using these industrial automation modules for data acquisition or control tasks are at risk if they have not updated to the specified version or later.
The ADAM-3600 is commonly deployed in manufacturing and infrastructure environments where network exposure may be limited but not nonexistent. Any instance of this hardware accessible from a network segment reachable by an attacker is potentially vulnerable to this authentication bypass.
What should you do?
Security teams should immediately inventory their environments to identify any Advantech ADAM-3600 units currently in operation. Checking the firmware version on each device is the first step to determining exposure to CVE-2026-43845 and related vulnerabilities.
If devices are running versions older than 2.8.5.0, they should be isolated from untrusted networks until an update can be applied. Network segmentation can help limit the ability of attackers to reach the password reset interface on these modules.
What to do and how to stay safe: Advantech
- Audit industrial control system networks to locate all Advantech ADAM-3600 devices and verify their current firmware versions.
- Restrict network access to the password reset interface of these modules using firewalls or VLAN segmentation until patches are deployed.
- Monitor logs for unusual authentication attempts or password reset requests that may indicate exploitation of CVE-2026-43845.
- Apply vendor-provided firmware updates to version 2.8.5.0 or later as soon as they are available and tested in your environment.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-43845?
The National Vulnerability Database rates CVE-2026-43845 as a 9.2, which is classified as Critical.
Which Advantech products are affected by this vulnerability?
The vulnerability affects Advantech ADAM-3600 modules running firmware versions prior to 2.8.5.0.
How can an attacker exploit this flaw?
An attacker can exploit the vulnerability by targeting the password reset mechanism to bypass the authentication process.
