Description
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
Published: 2026-10-20
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A NULL pointer dereference flaw exists in the license manager service’s rpc_rx_fsm function of the Advantech ADAM‑3600. An attacker can trigger the service to crash, causing a denial of service to the device’s functionality. No compromise of confidentiality or integrity is reported, and the effect is limited to service interruption.

Affected Systems

The vulnerability affects devices running Advantech ADAM‑3600. No specific firmware revision range is provided by the vendor, but the issue is present in currently deployed versions until the vendor’s update is applied.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to reach the device via the exposed license manager RPC interface and are not required to authenticate.

Generated by OpenCVE AI on October 20, 2026 at 15:32 UTC.

Remediation

Vendor Solution

Advantech has released a security update to address these vulnerabilities. Users and administrators of affected product versions are advised to update to the latest version immediately.

OpenCVE Recommended Actions

  • Apply the security update for the ADAM‑3600 issued by Advantech immediately.
  • If the update cannot be applied right away, isolate the device from external networks to prevent unauthenticated RPC access.
  • After updating, verify that the license manager service restarts correctly and monitor system logs for any further crash events.

Generated by OpenCVE AI on October 20, 2026 at 15:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Title NULL Pointer Dereference in Advantech ADAM‑3600 License Manager Service Allows Crash
Weaknesses CWE-476

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CSA

Published:

Updated: 2026-10-20T08:32:31.027Z

Reserved: 2026-05-04T03:13:39.244Z

Link: CVE-2026-43841

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T09:17:10.490

Modified: 2026-10-20T09:17:10.490

Link: CVE-2026-43841

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T15:45:16Z

Weaknesses