Advantech ADAM-3600 EUVD-2026-104848

Exploitation requires network access to the ADAM-3600's proprietary management protocol service and the ability to understand/interact with that protocol (reflected by AT:P), but needs no credentials or prior privileges (PR:N) and no user interaction (UI:N). The specific defect is that the SafeEnhancement feature - the control intended to restrict repeated login attempts - fails to enforce lockout/rate-limiting, so brute forcing the administrator password succeeds even when SafeEnhancement is enabled. Limiting factors for defenders: success is bounded by administrator password strength and attack time (AC:H), the attacker must reach the device's protocol port (commonly on segmented OT/ICS networks), and the proprietary protocol raises the implementation bar for an attacker.

Signals are mixed and point to a moderate, not emergency, priority. The input provides only a CVSS 4.0 base vector (8.2, HIGH): AV:N (network-reachable), AC:H and AT:P (meaningful attack requirements - the attacker must understand and interact with Advantech's proprietary protocol and succeed at an inherently time/entropy-dependent brute force), PR:N (no prior privileges) and UI:N (no victim interaction). Impact in the input is scoped to confidentiality only (VC:H, VI:N, VA:N), reflecting recovery of the administrator password; in practice obtaining admin credentials would grant full device control, so the real-world impact is arguably broader than the vendor's confidentiality-only scoping - verify intended scope with Advantech. No EPSS score, no CISA KEV listing, and no POC were supplied, so there is no evidence of active or automatable exploitation; the core defect is that the SafeEnhancement anti-brute-force control fails to enforce lockout/rate-limiting. Net: a genuine authentication-hardening flaw on an OT device, worth prioritizing for ICS operators exposing the management protocol, but absent exploitation signals it is not a drop-everything issue - high CVSS driven by network reach and admin impact, tempered by AC:H/AT:P and no observed exploitation.

An attacker with network reachability to an Advantech ADAM-3600 controller repeatedly submits administrator credential guesses over the device's proprietary management protocol; because the SafeEnhancement feature does not actually throttle or lock out repeated attempts, the attacker can brute force the admin password and gain administrative access. No public exploit code was identified at time of analysis, and the attack requires understanding the proprietary protocol plus time proportional to password strength.