The vulnerability is a stack-based buffer overflow located in the login function of the Advantech ADAM-3600 device, enabling attackers to execute arbitrary code on the target system. The impact can be total takeover of the device, permitting further lateral movements or data exfiltration if the device is network‑connected. This is a high‑severity flaw with a CVSS score of 9.2, indicating that any successful exploitation compromises confidentiality, integrity, and availability.

Affected hosts are models in the Advantech ADAM-3600 product line. The issue appears in all current releases documented by Advantech, with a formal fix issued in the latest firmware update; older firmware versions retain the vulnerability.

The EPSS score is under 1 %, indicating that at present the exploitation probability is very low, but the high CVSS score means that attackers may attempt exploitation once a vulnerability is publicly disclosed and the device is not patched. Because the flaw exists in the login interface, an attacker must reach the device over the network or physical connection that allows sending a crafted credential request. The vulnerability is not listed in the CISA KEV catalog, so it is not known to be actively exploited in the wild yet, but the code‑execution potential warrants prompt mitigation.