Quick answers
- Is CVE-2026-6890 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-6890 being exploited in the wild.
- How severe is CVE-2026-6890?
- Informational severity, with a CVSS score of 7.1, published 31 July 2026.
- Which products and versions are affected?
- Advantech EdgeLink prior to 2.8.5.0.
- Is there a fix for CVE-2026-6890?
- A patch was published on 2026-07-31: Advantech released EdgeLink version 2.8.5.0 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-6890 attacked?
- It is attacked from the adjacent network, in an operating system.
- Am I affected by CVE-2026-6890?
- Check whether you run Advantech EdgeLink at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Advantech ECU-1251D industrial communication gateway suffers from a use of default credentials vulnerability. The device manual documents a default 'root' account with no password for SSH access, and the system does not prompt or require users to change these credentials during initial configuration. An attacker with network access to the device (specifically the SSH service) can gain full root-level shell access. This vulnerability affects ECU-1251D products running EdgeLink versions prior to 2.8.5.0. Advantech has released a security update to address this issue.
Affected products
- Advantech ECU-1251D (EdgeLink) prior to 2.8.5.0
Timeline
- 2026-07-31: advisory: Advisory published by the Cyber Security Agency of Singapore (CSA)
- 2026-07-31: patched: Advantech released EdgeLink version 2.8.5.0 to address the issue.