Luis Villalba Pérez

**Name of the Vulnerable Software and Affected Versions** Advantech ADAM-5550 (affected versions not specified) **Description** The issue is related to the use of weak encryption algorithms in the Advantech ADAM-5550, specifically base 64 encoding, which can allow an attacker to disclose user credentials. This may lead to unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Advantech ADAM 5550 (affected versions not specified) **Description** The device's web application includes a "logs" page where all HTTP requests received are displayed to the user. However, it fails to correctly neutralize malicious code when parsing HTTP requests to generate page output, potentially exposing users to code injection attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Advantech ADAM-5630 (affected versions not specified) Description: The issue concerns the cookies of authenticated Advantech ADAM-5630 users, which remain active and valid even after a session is closed. This allows an unauthorized attacker to forge requests with a legitimate cookie, granting them the same level of privileges as the legitimate user. The vulnerability may enable a remote attacker to gain unauthorized access to protected information and elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Advantech ADAM-5630 (affected versions not specified) **Description** The issue is related to the lack of authentication for a critical function in the Advantech ADAM-5630 programmable logic controller (PLC). This allows a remote attacker to execute arbitrary commands, potentially leading to a denial of service. The device has built-in commands that can be executed without user authentication, including restarting the operating system, rebooting the hardware, and stopping execution. These commands can be sent via a simple HTTP request and are executed automatically without discriminating the origin or privileges of the user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.