Quick answers
- Is CVE-2026-6889 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-6889 being exploited in the wild.
- How severe is CVE-2026-6889?
- Informational severity, with a CVSS score of 6.9, published 31 July 2026.
- Which products and versions are affected?
- Advantech ECU-1251D EdgeLink versions prior to 2.8.5.0.
- Is there a fix for CVE-2026-6889?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-6889 attacked?
- It is attacked from the adjacent network, in a network appliance.
- Am I affected by CVE-2026-6889?
- Check whether you run Advantech ECU-1251D or Advantech EdgeLink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial of service (DoS) vulnerability exists in the DNP3Daemon component of the Advantech ECU-1251D industrial gateway. The flaw is triggered when a network-adjacent attacker sends a DNP3 signal to the Digital Output address of the device. This causes the daemon to attempt to invoke a non-existent system file, resulting in an indefinite restart loop. While the web management panel remains partially accessible, SCADA TelWin operators lose the ability to reconnect to the device. The vulnerability is addressed in EdgeLink version 2.8.5.0 and later.
Affected products
- Advantech ECU-1251D EdgeLink versions prior to 2.8.5.0
Timeline
- 2026-07-30: disclosed: CVE record published by CSA Singapore
- 2026-07-31: advisory: NVD entry and CSA Singapore alert published