CVE-2024-38308: Advantech ADAM 5550 XSS Vulnerability

CVE-2024-38308 Overview

CVE-2024-38308 is a stored cross-site scripting (XSS) vulnerability in the Advantech ADAM-5550 industrial controller. The device's web application exposes a logs page that renders received HTTP requests back to authenticated operators. The firmware fails to neutralize malicious content when parsing HTTP requests to generate page output, mapping to [CWE-79]. An adjacent-network attacker can inject script payloads by crafting HTTP requests to the device. When an operator later views the logs page, the payload executes in the operator's browser context.

Critical Impact
Adjacent-network attackers can execute arbitrary script in operator browsers, enabling session hijack, configuration changes, and pivoting deeper into industrial control system (ICS) networks.

Affected Products

Advantech ADAM-5550 (hardware)
Advantech ADAM-5550 firmware
ICS deployments exposing the ADAM-5550 web interface on operator networks

Discovery Timeline

2024-09-27 - CVE-2024-38308 published to NVD
2024-09-26 - CISA published ICS Advisory ICSA-24-270-01
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38308

Vulnerability Analysis

The ADAM-5550 web application includes a diagnostic logs page that displays HTTP requests received by the device. The firmware writes request fields, including method, URI, headers, and query parameters, directly into the HTML output without contextual encoding. Any attacker able to send an HTTP request to the controller can inject HTML or JavaScript that persists in the logs view. The stored payload runs whenever an administrator opens the logs page.

Exploitation requires only network reachability to the device, no authentication, and no user interaction to plant the payload. Successful execution runs script in the operator's authenticated session, giving the attacker the same web-interface privileges as the operator viewing the log.

Root Cause

The root cause is missing output encoding in the HTML template that renders logged HTTP requests. Request-derived data flows into the DOM without HTML entity encoding or attribute sanitization. Because the sink is HTML, attacker-controlled request bytes are interpreted as markup and script.

Attack Vector

The attack vector is adjacent network (AV:A). An attacker on the same layer-2 segment, VLAN, or routed operator network as the ADAM-5550 sends an HTTP request containing a script payload embedded in a URI path, query string, or header. The device stores and later renders the payload verbatim in the logs page. When an engineer or operator views the logs, the browser executes the injected script, which can exfiltrate session cookies, submit configuration changes on behalf of the operator, or trigger control-plane actions exposed by the web interface.

No verified public proof-of-concept is available. See the CISA ICS Advisory ICSA-24-270-01 for vendor-supplied technical detail.

Detection Methods for CVE-2024-38308

Indicators of Compromise

HTTP requests to the ADAM-5550 web interface containing <script>, onerror=, onload=, or encoded variants (%3Cscript%3E) in the URI, query string, or headers.
Unusual outbound requests originating from operator workstations shortly after accessing the ADAM-5550 logs page.
Unexpected configuration changes on the controller correlated with an operator log-page view.

Detection Strategies

Deploy an ICS-aware network intrusion detection system on operator VLANs to flag HTTP payloads targeting Advantech ADAM devices with XSS signatures.
Alert on any HTTP request to the ADAM-5550 containing angle brackets, JavaScript URI schemes, or event-handler attributes in request fields.
Correlate operator browser telemetry with device access logs to detect script execution following a logs-page visit.

Monitoring Recommendations

Capture full HTTP request logs from the operator network segment that hosts the ADAM-5550 for retrospective search.
Monitor for new or modified accounts, uploaded configuration files, and outbound connections from workstations that manage the controller.
Baseline expected management traffic to the ADAM-5550 and alert on requests from unexpected sources.

How to Mitigate CVE-2024-38308

Immediate Actions Required

Remove the ADAM-5550 web interface from any network reachable by untrusted hosts and restrict access to a dedicated engineering workstation subnet.
Apply vendor firmware updates referenced in CISA ICS Advisory ICSA-24-270-01 as soon as Advantech releases them.
Instruct operators to avoid opening the logs page until mitigations are in place, and to clear browser sessions after each administrative task.

Patch Information

Refer to the CISA ICS Advisory ICSA-24-270-01 for Advantech's current guidance on fixed firmware versions and vendor mitigations for the ADAM-5550 platform.

Workarounds

Place the ADAM-5550 behind an ICS firewall and permit HTTP management traffic only from allow-listed engineering workstations.
Disable or block external access to the web interface where field diagnostics are not required, using serial or local console management instead.
Enforce browser isolation or a dedicated management browser profile for staff who administer the controller to contain any script execution.

bash

# Example ICS firewall rule limiting ADAM-5550 web access to engineering hosts
iptables -A FORWARD -p tcp -d <ADAM_5550_IP> --dport 80 \
  -s <ENGINEERING_WORKSTATION_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <ADAM_5550_IP> --dport 80 -j DROP