The CVE describes a command injection flaw that allows an authenticated attacker to execute arbitrary system commands with root privileges on the Advantech ADAM‑3600. This gives the attacker complete control over the device, enabling tampering with configuration, extraction of sensitive data, or establishing persistence for lateral movement into a broader network. As the affected code runs with root privileges, the compromise results in a full loss of confidentiality, integrity, and availability.

The vulnerability is limited to the Advantech ADAM‑3600 industrial automation device. Only the firmware releases mentioned in Advantech’s advisory are known to contain the flaw; the vendor recommends upgrading to the latest version. No other variants or models are listed as affected.

The CVSS score of 8.6 indicates high severity. The EPSS score of 1% shows that, while exploitation is possible, its likelihood in the wild is low, and the vulnerability is not yet listed in CISA’s KEV catalog. Because the flaw requires authentication, an attacker must have valid credentials or gain access via another local vulnerability; from there they can inject commands to obtain root access. Organizations deploying the ADAM‑3600 should treat this as a high risk for devices that expose administrative interfaces to untrusted networks or that store credentials insecurely.