Advantech ADAM-3600 EUVD-2026-104835

Exploitation requires the attacker to first hold guest-level authentication credentials on the targeted Advantech ADAM-3600 controller; the vulnerable code path is specifically the device's password verification functionality, which is reachable post-authentication. The attack is network-reachable (AV:N) but carries high complexity (AC:H), meaning reliable exploitation depends on satisfying precise memory-corruption conditions rather than a single trivial request. Limiting factors: valid (even guest) credentials are needed, exploitation is non-trivial, and the target is a specialized industrial device typically deployed on segmented OT networks - note the description's 'guest authentication' conflicts with the vendor vector's PR:H, so the real authentication barrier may be lower than the score implies.

This is a moderate-priority vulnerability that does not rise to emergency status despite enabling code execution. The CVSS 4.0 base score of 7.5 (HIGH) is tempered by two significant friction factors in the vendor-supplied vector: AC:H (high attack complexity, typical of buffer-overflow exploitation that requires precise memory conditions) and PR:H (privileges required). No EPSS score, CISA KEV listing, or public proof-of-concept was provided, so the exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or widespread weaponization. A notable internal conflict exists: the CVSS vector encodes PR:H (high privileges), yet the description states the attacker only needs 'guest authentication,' which normally maps to low privilege (PR:L) - verify the true privilege barrier with Advantech, as this materially changes the risk (guest-level access is a much lower bar than administrative access). The VC:H/VI:H/VA:H impact confirms full compromise of the affected device if exploited. Because the ADAM-3600 is an industrial RTU/edge controller deployed in OT/SCADA environments, the practical risk is elevated by the sensitivity of the target rather than by exploitation ease; prioritize patching where these devices are network-reachable, but the AC:H and authentication requirement argue against this being a mass-exploitation candidate.

An attacker who has obtained or been granted guest-level credentials to an Advantech ADAM-3600 controller sends specially crafted input to the password verification routine, overflowing a buffer to corrupt memory and achieve arbitrary code execution on the device. Because the attack vector is network-based but carries high complexity, the attacker must reliably satisfy specific memory conditions, likely requiring multiple attempts or detailed knowledge of the target firmware. No public exploit code has been identified at the time of analysis.