CVE-2024-39275

highpriority · track · 35EPSS 0.004 · 34 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.41% (34th) EPSS

CVSS 8.8 · high

Is it mine?

5 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-24

Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. Forging requests with a legitimate cookie, even if the session was terminated, allows an unauthorized attacker to act with the same level of privileges of the legitimate user.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationAdvantech ADAM-5630cisa_csaf_ot
Advantech recommends users upgrade their ADAM-5630 devices to version 2.5.2.
https://www.advantech.com/zh-tw/support/details/firmware?id=1-1WFJLZ4

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.8

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18highCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.18highCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ics-cert@hq.dhs.gov USexploitability 2.1 · impact 5.9

v3.18highAV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v4.08.5highCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.08.5highCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · ics-cert@hq.dhs.gov US

v4.05.9mediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-539USCWE-539USCWE-539US

affected products (5)

Products and version ranges known to be affected.

Advantech Advantech ADAM-5630: <v2.5.2all versionscisa_csaf_otUS
Advantech Advantech ADAM-5630< v2.5.2cisa_csaf_otUS
Advantech ADAM-56300 → v2.5.2enisa_euvdEU
Advantech Co., Ltd ADAM5630≤ 2.5.2fstec_bduRU
advantech adam-5630 firmware< 2.5.2nvdUScpe:2.3:o:advantech:adam-5630_firmware:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-24-270-02Advantech ADAM 56302024-09-26icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to hijack a legitimate user's session, perform cross-site request forgery, or cause a denial-of-service condition.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

published 2024-09-27modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

https://cxsecurity.com/cveshow/CVE-2024-39275/cnnvd
https://www.advantech.com/Patchcnnvd
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02 cnnvd
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02 enisa_euvd
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02Third Party AdvisoryUS Government Resourcenvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan