CVE-2026-43854: Vulnerability in Advantech ADAM-3600

This vulnerability in Advantech ADAM-3600 devices enables an attacker with access to an encrypted project file to extract administrator credentials for EdgeLink-enabled devices. The CVSS 4.0 score is 6.3, reflecting a medium severity with local attack vector, low attack complexity, and requiring low privileges. The vulnerability does not require user interaction and has high scope and impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker with access to an encrypted project file can retrieve administrator credentials, potentially allowing unauthorized administrative access to EdgeLink-enabled ADAM-3600 devices. This could lead to unauthorized device control or configuration changes. However, exploitation requires local access to the encrypted file and low privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to encrypted project files and ensure they are stored securely to prevent unauthorized local access.