A flaw in the firmware upgrade process on the Advantech ADAM-3600 allows an attacker who can authenticate to the device to upload a forged firmware image. The lack of proper verification of the firmware package means the attacker could replace the legitimate firmware with malicious code, potentially taking full control of the device and rendering it permanently compromised. The weakness involves improper access control and lack of authenticity checks, consistent with common firmware update vulnerabilities.

The vulnerability affects product line Advantech ADAM-3600. Version information is not specified in the advisory; the update contains a fix and users should move to the latest firmware revision offered by Advantech.

The CVSS score of 8.6 indicates a high severity. The EPSS score of less than 1% suggests a low but non‑zero probability of exploitation in the wild. Because the attack requires authenticated access to the firmware upload interface, the likely vector is a legitimate user or compromised credential that is able to trigger the upgrade process. This vulnerability is currently not listed in CISA's KEV catalog, but the high impact warrants prompt action.