Vulnerability · Published Sep 27, 2024 · Assigned by icscert
CVE-2024-39364Advantech ADAM-5630 Missing Authentication for Critical Function
Medium 6.3
In plain English
A medium-severity missing authentication in ADAM-5630 from Advantech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, rebooting the hardware, and stopping the execution. The commands can be sent to a simple HTTP request and are executed by the device automatically, without discrimination of origin or level of privileges of the user sending the commands.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H