CVE-2026-43838

9.2Critical

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.2Critical

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: —

Impact

Unauthenticated attackers can execute arbitrary code over the network by exploiting the login interface. They need network reachability to the exposed login service.

Root cause

A stack-based buffer overflow exists within the login handling logic.

Affected systems

Advantech products; exact versions not listed — check the vendor advisory.

CVSS v4.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Consult the Advantech security advisory for updated firmware or software versions. As an interim workaround, restrict or isolate network access to the management and login interfaces using firewall rules.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-43838