Advantech ADAM-3600 EUVD-2026-104843

Exploitation requires network reachability to the ADAM-3600 license manager RPC service; the attacker sends a crafted RPC message with the msglen field set to 0, which triggers the NULL pointer dereference in rpc_rx_fsm. No authentication, credentials, or user interaction are needed (PR:N/UI:N). The practical limiting factor is network exposure: as an ICS/OT RTU, the ADAM-3600's license manager port is typically on a segmented operational network rather than internet-facing, and impact is bounded to crashing that service (availability only - no code execution or data access).

This is a medium-severity denial-of-service issue, not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated trigger, but impact is confined to availability of a single subsystem (VA:L; VC:N/VI:N/VA:L with no confidentiality or integrity effect and no scope change), yielding the modest 6.9 score. There is NO code execution, data exposure, or persistence - only a service crash. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified; the absence of these signals is not evidence of safety but does mean there is no indication of active or imminent exploitation. The signals are internally consistent (low-complexity unauthenticated network DoS), so no contradiction needs flagging; the main caveat is that real-world exposure depends heavily on whether the license manager port is reachable, which for ICS/OT gear like the ADAM-3600 is often mitigated by network segmentation.

An attacker with network access to an exposed ADAM-3600 license manager service sends a malformed RPC message with the msglen field set to 0, triggering a NULL pointer dereference in rpc_rx_fsm that crashes the service. No authentication or user interaction is required. No public exploit code was identified in the provided data, so this is a plausible but not-yet-published attack path.