NULL Pointer Dereference in License Manager Service Affects Advantech Products
CVE-2026-43841

6.9MEDIUM

Key Information:

Vendor

Advantech
Status
Adam-3600
Vendor
CVE Published:
20 October 2026

What is CVE-2026-43841?

A vulnerability has been identified in the License Manager Service where a NULL pointer dereference can be exploited by unauthenticated attackers. Through manipulation of the rpc_rx_fsm function, an attacker could potentially crash the service, leading to service degradation and interruption. Users of Advantech's affected products should assess their systems and apply necessary patches or mitigations to safeguard against possible exploitation.

Affected Version(s)

ADAM-3600 prior to version 2.8.5.0

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-20...
https://www.advantech.com/en/security-advisory
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Simone Bossi and Raffaele Bova at Nozomi Networks
.