Key points
- CVE-2026-43847 affects Advantech ADAM-3600 units running versions prior to 2.8.5.0.
- The National Vulnerability Database rates the issue as high severity with a CVSS score of 8.2.
- Attackers can brute force administrator passwords even when the SafeEnhancement feature is enabled.
Advantech ADAM-3600 industrial modules running firmware versions earlier than 2.8.5.0 contain a high-severity authentication flaw. The National Vulnerability Database identifies this issue as CVE-2026-43847, noting that it exposes administrative accounts to unrestricted password guessing attacks.
What happened
The vulnerability resides within the proprietary communication protocol used by the Advantech ADAM-3600 hardware. According to the NVD record, an attacker interacting with the affected protocol can attempt to brute force the administrator password without any rate-limiting restrictions. This capability persists even if the device’s SafeEnhancement security feature is actively enabled. The flaw applies specifically to units operating on software versions prior to the 2.8.5.0 release.
Why it matters
Organisations using these modules for industrial automation face a direct risk of credential compromise. As AppSec Scoop reported on 20 October 2026, previous critical flaws in these units allowed attackers to skip authentication checks entirely. This new issue differs by allowing repeated login attempts rather than a single bypass, but the outcome remains similar. A CVSS score of 8.2 indicates a high potential for damage if an attacker successfully guesses the administrative credentials.
What happens next
Security teams must verify the firmware versions of all deployed ADAM-3600 units. Those running software older than version 2.8.5.0 are vulnerable to this brute-force attack. Users should plan to upgrade their devices to the patched version to eliminate the risk. Until the update is applied, the administrative accounts remain exposed to automated guessing tools.
Patch priority
Teams usually prioritise systems exposed to untrusted networks or remote access points for immediate remediation. Check whether affected devices sit behind network segmentation controls that limit protocol access. Back up current configurations before initiating firmware upgrades to ensure operational continuity. Test the update in a staging environment if possible to verify stability. Reduce exposure by restricting network access to the proprietary protocol ports until patches are deployed. Monitor logs for repeated authentication failures that may indicate active brute-force attempts.
What to do and how to stay safe: Advantech
- Inventory all Advantech ADAM-3600 devices to identify those running firmware versions prior to 2.8.5.0.
- Apply network segmentation rules to restrict access to the proprietary protocol ports used by these modules.
- Monitor authentication logs for unusual spikes in failed login attempts that suggest brute-force activity.
- Plan a maintenance window to upgrade vulnerable units to version 2.8.5.0 or later once available.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Advantech products are affected by CVE-2026-43847?
The vulnerability affects Advantech ADAM-3600 units running firmware versions prior to 2.8.5.0.
Is the SafeEnhancement feature effective against this brute-force attack?
No, the NVD record states that attackers can brute force passwords even when the SafeEnhancement feature is enabled.
What is the severity rating for CVE-2026-43847?
The National Vulnerability Database rates the vulnerability as high severity with a CVSS score of 8.2.
