This vulnerability is a classic path traversal flaw that allows an authenticated attacker to read any file on the underlying system. By manipulating the file path input, the attacker can bypass normal file access restrictions, potentially exposing configuration files, passwords, or other sensitive data. The weakness maps to the path traversal category (CWE‑22) and can lead to information disclosure without further compromise.

The affected product is Advantech ADAM‑3600. The vendor has released a security update; no specific version range is provided, so all installations of the ADAM‑3600 product family are likely vulnerable until updated.

The CVSS score of 8.2 indicates high severity, yet the EPSS score of less than 1% shows a very low probability that exploitation is occurring in the wild. The vulnerability requires authenticated access, meaning attackers must compromise legitimate credentials before exploitation. Consequently, the risk is primarily confined to environments with weak credential controls or exposed interfaces. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been reported. Policy and configuration changes that tighten authentication and limit file read APIs can mitigate the risk until the vendor patch is applied.