Advantech has 65 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 47 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 25. The median CVSS is 8.6 (high), with 10 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-89 (8) and CWE-78 (7). Most affected products: ADAM-3600 (30), EKI-1242IEIMS (15), webaccess/vpn (12).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.6
- Publish → KEV
- —
- Last 90 days
- 47 prev 0
Products
- ADAM-3600 30
- EKI-1242IEIMS 15
- webaccess/vpn 12
- deviceon/iedge 3
- WISE-6610-NB 2
- wise-deviceon_server 2
Worst active — by depth score
CVE-2026-79698Critical· 9.9A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WIS…67CVE-2026-79697Critical· 9.9A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WIS…67CVE-2026-73172Critical· 9.3Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01…52CVE-2026-43845Critical· 9.2A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.51CVE-2026-43844Critical· 9.3A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.51
Advantech vulnerabilities
CVEs affecting Advantech, newest first. Open any entry for full detail, references, and exploit status.
65 CVEsRSS
CVE-2026-43834High· 7.5A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
CVE-2026-43835High· 8.6A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
CVE-2026-43837High· 7.5A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
CVE-2026-43836Critical· 9.3A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
CVE-2026-43854Medium· 6.3A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.
CVE-2026-43840Medium· 6.9A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.
CVE-2026-43838Critical· 9.2A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
CVE-2026-43841Medium· 6.9A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
CVE-2026-43839High· 8.7A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
CVE-2026-43845Critical· 9.2A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
CVE-2026-43842Medium· 6.9A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.
CVE-2026-43846High· 8.6A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
CVE-2026-43844Critical· 9.3A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
CVE-2026-43843Medium· 6.9An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.
CVE-2026-43851High· 8.2A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
CVE-2026-43849Medium· 6.9A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
CVE-2026-43848Medium· 6.9A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
CVE-2026-43847High· 8.2A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
CVE-2026-43853High· 8.2A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
CVE-2026-43852High· 8.2A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
CVE-2026-43850High· 8.6A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
CVE-2026-43856High· 8.6A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
CVE-2026-43857High· 8.6A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
CVE-2026-43855High· 7.5A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
CVE-2026-43858High· 8.6A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
CVE-2026-73177High· 8.6Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images thro…
CVE-2026-73176High· 8.6Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 th…
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 th…
CVE-2026-73175High· 7.1Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust…
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust…
CVE-2026-73174High· 8.7Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive o…
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive o…
CVE-2026-73173High· 8.8Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attack…
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attack…