Cyber Resilience

CVE-2024-39275

Advantech Adam-5630 Firmware ≤ 2.5.2

Published
27 September 2024
Modified
07 October 2024
CVSS Score v4 8.5
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0039 32th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2024-39275 is a high-severity Use of Persistent Cookies Containing Sensitive Information (CWE-539) vulnerability in Advantech Adam-5630 Firmware. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. Forging requests with a legitimate cookie, even if the session was terminated, allows an unauthorized attacker to act with the same level of privileges…

more

of the legitimate user.

CWE(s)
CWE-539NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise Techniques

T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1528 Steal Application Access Token Credential Access
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-34542Same product: Advantech Adam-5630
CVE-2024-28948Same product: Advantech Adam-5630
CVE-2026-24318Shared CWE-539
CVE-2025-27673Shared CWE-539
CVE-2023-30861Shared CWE-539
CVE-2026-35192Shared CWE-539
CVE-2025-52633Shared CWE-539
CVE-2025-34260Same vendor: Advantech
CVE-2025-48470Same vendor: Advantech
CVE-2025-34266Same vendor: Advantech

Affected Assets

advantech
adam-5630 firmware
≤ 2.5.2

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices and coding standards directly prohibit storing sensitive data in persistent cookies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect and prevent use of persistent cookies with sensitive data.

A.5.34 Privacy and protection of PII partial match
mitigates

Privacy and PII protection policies require safeguards against exposing sensitive data via cookies.

A.8.1 User end point devices partial match
degrades

Endpoint device configuration can enforce cookie lifetime and encryption policies.

A.8.10 Information deletion partial match
mitigates

Information deletion policies can mandate removal or encryption of sensitive cookie data.

A.8.12 Data leakage prevention partial match
mitigates

Data leakage prevention controls can block or encrypt sensitive information in cookies.

A.8.24 Use of cryptography partial match
degrades

Cryptographic controls can mandate encryption of sensitive data stored in cookies.

References