CVE-2026-43836
9.3CriticalPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- —
Impact
Unauthenticated remote attackers can execute arbitrary commands with maximum privileges by sending forged network packets. No credentials or user interaction are required.
Root cause
The device improperly validates incoming network packets, allowing attackers to forge packets that trigger command execution.
Affected systems
Advantech products; exact models and version ranges not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Consult the Advantech security advisory for the target patched firmware or software version. As an interim mitigation, restrict or block network access to affected Advantech devices at the firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.