A heap memory read vulnerability in the Advantech ADAM-3600 allows an attacker to read arbitrary memory locations and exfiltrate sensitive data stored in the device’s heap. The primary impact is the potential compromise of confidentiality, as unauthorized individuals could obtain confidential configuration or operational information without modifying the system. The weakness is a classic out‑of‑bounds read that can reveal data beyond the intended buffer boundaries.

The ADAM-3600 line of industrial controllers from Advantech is affected. No specific version ranges are listed, but the vulnerability exists in any firmware that has not been updated with the recent security patch released by Advantech.

The CVSS score of 6.9 classifies the issue as moderately severe, while the EPSS score of less than 1% indicates a low likelihood that this vulnerability is actively exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited known exploitation. The attack likely requires an attacker to send crafted input to the device, possibly over local or exposed network interfaces, to trigger the memory read. Since details on the exact attack vector are not provided, it is inferred that the vector involves remote interactions over the device’s network stack.