The vulnerability is a NULL pointer dereference occurring in the license manager service’s on_disconnected callback. An unauthenticated attacker can trigger this flaw to force the service to crash. The flaw does not provide code execution or data exposure; it results in denial of service for users relying on the license manager.

The affected asset is Advantech ADAM-3600. The vulnerability applies to all released firmware variants of the ADAM-3600’s license manager service for which the flaw existed. No specific patch version is listed, but the CNA notes that any current or previous releases lacking the update are vulnerable.

The CVSS score of 6.9 indicates a moderate to high impact severity. The EPSS score of <1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, because the flaw can be triggered remotely by an unauthenticated user, it should be considered a potential attack vector for denial-of-service attacks. The attack can be launched without authentication, implying that the service is exposed to the network or local attackers depending on how the license manager is configured.