The flaw is a command‑injection vulnerability in the firmware upgrade file verification routine of the Advantech ADAM‑3600. Unsanitized user‑supplied data is incorporated into system commands, allowing an attacker to run arbitrary code with the privileges of the firmware verification process. Classified as CWE‑77, the vulnerability could lead to full control over the device if an attacker can supply a crafted upgrade file. The high CVSS score of 8.6 indicates a severe impact for affected systems.

The affected product is the Advantech ADAM‑3600. The CVE does not specify which firmware releases contain the flaw, so any installed revision prior to the official update could be vulnerable.

With an EPSS score of 2.5 % the likelihood of exploitation is moderate, and the CVE is not listed in the CISA KEV catalog, suggesting no confirmed active attacks yet. The flaw can be triggered by an attacker who can supply a malicious upgrade file, so exposure is limited to systems that accept firmware updates from untrusted sources or via a network interface. Administrators should deploy the vendor’s security update immediately to eliminate the risk, and consider restricting firmware update access otherwise.