Advantech ADAM-3600 EUVD-2026-104842

Exploitation requires network reachability to the ADAM-3600's license manager RPC service, which must process attacker-supplied messages via the rpc_rx_fsm function; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. Limiting factors: the device/service must be network-exposed (typical OT segmentation or firewalling would restrict reachability), and impact is bounded to availability (VA:L) - the flaw crashes the service but does not grant code execution or data access. Realistic risk is highest where ADAM-3600 units are directly reachable from untrusted networks.

This is a moderate, availability-only issue, not a top-tier priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) describes a remotely reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact and only LOW availability impact - consistent with a service crash (NULL pointer dereference) rather than code execution or data compromise, which is why the score lands at 6.9 (Medium) despite being network/unauthenticated. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so there is no signal of active or probable exploitation; absence of these is not evidence of safety but does lower urgency relative to a KEV-listed RCE. The main risk driver is operational: the ADAM-3600 is an industrial RTU/controller, so a repeatable remote crash of the license manager service could disrupt field operations. Note that the single LOW availability impact suggests the crash affects only the license manager service, not necessarily the whole device - verify with the Advantech advisory whether a crash cascades to core control functions.

An attacker with network reachability to an exposed ADAM-3600 sends a crafted RPC message that is processed by the rpc_rx_fsm function, triggering a NULL pointer dereference that crashes the license manager service with no authentication or user interaction required. Repeated requests could sustain a denial-of-service condition against the device. No public exploit identified at time of analysis.