PatchSiren cyber security CVE debrief

CVE-2024-39364 Advantech CVE debrief

Advantech ADAM-5630 devices contain built-in commands that execute without authentication, allowing unprivileged network attackers to restart the operating system, reboot hardware, or stop execution via simple HTTP requests. The vulnerability stems from missing authentication and authorization checks on administrative command endpoints, with no origin validation or privilege discrimination. CISA published advisory ICSA-24-270-02 on September 26, 2024, with a CVSS 3.1 score of 6.3 (Medium). The attack vector is adjacent network, requires low attack complexity, no privileges, and user interaction. Affected versions are prior to 2.5.2. Advantech has released firmware version 2.5.2 to address this issue. No known exploitation in ransomware campaigns has been reported.

Vendor: Advantech
Product: ADAM-5630
CVSS: MEDIUM 6.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-09-26
Original CVE updated: 2024-09-26
Advisory published: 2024-09-26
Advisory updated: 2024-09-26

Who should care

Organizations operating Advantech ADAM-5630 devices in industrial control system or OT environments, particularly those in manufacturing, energy, water/wastewater, and critical infrastructure sectors where device availability impacts operational technology processes.

Technical summary

The Advantech ADAM-5630 industrial communication gateway exposes built-in administrative commands through HTTP endpoints without requiring authentication. Attackers on adjacent networks can send crafted HTTP requests to trigger operating system restarts, hardware reboots, or execution halts. The vulnerability exists due to absent authentication and authorization mechanisms on command endpoints, with no validation of request origin or user privilege level. This represents a significant availability risk for industrial control system deployments where continuous operation is critical.

Defensive priority

medium

Recommended defensive actions

Upgrade Advantech ADAM-5630 devices to firmware version 2.5.2 or later
Restrict network access to ADAM-5630 management interfaces to authorized administrative hosts only
Segment OT networks containing ADAM-5630 devices from enterprise and internet-facing networks
Monitor for unauthorized HTTP requests to device command endpoints
Apply defense-in-depth controls per CISA ICS recommended practices

Evidence notes

CISA CSAF advisory ICSA-24-270-02 confirms unauthenticated HTTP-accessible built-in commands for OS restart, hardware reboot, and execution stop on ADAM-5630 devices. CVSS 3.1 vector AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H yields 6.3 Medium severity. Affected product identified as Advantech ADAM-5630 versions below 2.5.2. Remediation guidance specifies upgrade to firmware version 2.5.2.

Sources and references

Verified primary and authoritative sources

CVE-2024-39364 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-39364

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-39364 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-39364

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-270-02.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.