Advantech ADAM-3600 EUVD-2026-104829

Exploitation requires an authenticated attacker with high privileges (PR:H) reaching the device's logs settings functionality - i.e., valid administrative/operator access to the ADAM-3600 management interface. The specific prerequisite is the ability to supply input to the logs settings feature, where a stack-based buffer overflow is triggered. Limiting factors that reduce realistic risk: the attacker must already hold privileged credentials (not an unauthenticated flaw), high attack complexity (AC:H) implies additional conditions must be met for reliable exploitation, and the target is a specialized industrial RTU typically segmented within OT networks. No user interaction is required (UI:N).

This is a moderate-priority vulnerability whose real-world risk is tempered by substantial preconditions. The provided CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:H/UI:N, score 7.5) shows that while the vulnerability is network-reachable, it requires high privileges (PR:H - an already-authenticated administrative user) and high attack complexity (AC:H), both of which meaningfully raise the bar for exploitation. The vulnerable-system impact is maximal (VC:H/VI:H/VA:H) and consistent with the 'code execution' outcome, with no scope/subsequent-system impact (SC:N/SI:N/SA:N). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or weaponization. The signals are internally consistent rather than conflicting: a high-impact but high-privilege, high-complexity bug in an industrial RTU. The practical risk is that an attacker who has ALREADY compromised or legitimately holds admin credentials to an ADAM-3600 device can escalate to full code execution on the OT device; it is not a mass-exploitable unauthenticated flaw. Note: CWE is listed as N/A in the input but the description ('stack-based buffer overflow') maps to CWE-121 - verify with vendor advisory.

An attacker who has obtained valid administrative credentials to an Advantech ADAM-3600 device's management interface navigates to the logs settings functionality and submits a crafted oversized input that overflows a stack buffer, overwriting the return address to execute attacker-controlled code on the device. Because AC:H and PR:H apply, the attacker must already hold privileged access and craft input that reliably wins the complexity conditions. No public exploit code was identified at time of analysis.