A flaw in the handling of encrypted project files in Advantech ADAM‑3600 allows an attacker who gains access to such a file to retrieve administrator credentials for EdgeLink‑enabled devices. The vulnerability stems from insecure cryptographic storage and sensitive data exposure, enabling attackers to compromise device security through credential disclosure.

The issue affects Advantech ADAM‑3600 devices. Specific affected revisions are not listed, so all releases of the ADAM‑3600 product family should be considered vulnerable until an official update is applied.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker must first obtain an encrypted project file—meaning the assault requires either physical or remote access to the file system of the EdgeLink device. Once privileged access is achieved, the attacker can extract administrator credentials, leading to potential full device takeover and network compromise.