What’s Vulnerable › Vulnerabilities
CVE-2024-39364: Advantech ADAM-5630 Missing Authentication for Critical Function
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-09-27 · updated 2026-06-17
- Weakness: CWE-306
Description
Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, rebooting the hardware, and stopping the execution. The commands can be sent to a simple HTTP request and are executed by the device automatically, without discrimination of origin or level of privileges of the user sending the commands.
Affected products
- Advantech ADAM-5630: before v2.5.2 — fixed in v2.5.2
How to fix
Upgrade to a fixed version: Advantech ADAM-5630 v2.5.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-39364 or the next vulnerability affects your stack