Advantech ADAM-5550

An attacker with network access to the ADAM-5550 can steal administrative credentials and gain full control of the device, potentially altering device configuration, disabling monitoring, or injecting malicious commands. This could disrupt remote telemetry, data acquisition, or process control functions depending on how the device is deployed.

Water utilities, municipalities, and manufacturing facilities using the Advantech ADAM-5550 industrial data acquisition and monitoring module are affected. This device is commonly deployed for remote temperature, humidity, analog input/output monitoring, and SCADA integration in utility substations, water treatment plants, and process control environments.

An attacker on the same local network or with routed network access to the device intercepts unencrypted or weakly encrypted credentials transmitted by legitimate users. The attacker then logs in with stolen credentials and injects malicious code into the web interface, which is executed when other users access the web page.