A NULL pointer dereference in the license manager service’s rpc_rx_fsm function occurs when msglen is set to 0, allowing an unauthenticated attacker to crash the service. The crash leads to a denial of service for users relying on the service, potentially disrupting any process that depends on the license manager. The vulnerability is a classic example of improper input handling that fails to validate message length before dereferencing a pointer.

The vulnerability affects the Advantech ADAM-3600 industrial automation controller. No specific version numbers are listed, so all released versions are considered potentially affected until further clarification. Users are advised to upgrade to the latest firmware supplied by Advantech.

The CVSS score of 6.9 classifies this as a medium severity vulnerability, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. Because the flaw can be triggered by an unauthenticated actor, the attack vector is likely remote via the exposed RPC interface, but an attacker must be able to send a crafted message with a zero length. The vulnerability is not currently listed in the CISA KEV catalog.