A flaw in the password reset workflow of the Advantech ADAM‑3600 series allows an attacker to circumvent standard authentication checks. By improperly validating reset requests, the system can grant access without verifying the user's credentials, effectively enabling an authentication bypass. This flaw aligns with CWE‑640, meaning the vulnerability stems from authorization bypass and improper credential handling. It can therefore let an attacker assume control of any account that can initiate a reset, potentially escalating to full administrative privileges depending on role configuration.

The affected product is the Advantech ADAM‑3600 series. The CNA data lists no specific firmware or software version numbers; thus, all releases of ADAM‑3600 lacking the described security update are considered vulnerable until patching. Administrators should verify whether their deployments run on the latest firmware or apply the official update as soon as it becomes available.

The CVSS base score of 9.2 indicates a critical severity, while the EPSS score of < 1% suggests that active exploitation is currently rare. Nevertheless, the impact of a successful bypass—unauthorized account control—justifies urgent remediation. The vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is remote over the public internet, as anyone able to trigger the password reset through the exposed web interface or API can exploit the flaw.