EUVD-2026-94153
GHSA-75h9-9962-658r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ADM web interface over network
-
DeliverySend crafted request to start-page-loader.cgi
-
ExploitInject headers via state parameter
-
ExecutionAbuse X-Sendfile to read arbitrary file
-
ImpactExfiltrate sensitive host files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization HTTP response header sanitization
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default ADM configurations, achievable with a single crafted HTTP request to start-page-loader.cgi that injects headers through the state parameter to drive the web server's standard X-Sendfile file-delivery mechanism. The only real limiting factors are: (1) network reachability of the ADM web interface (internet-exposed devices are at highest risk; LAN-only devices require attacker network presence), and (2) firmware version - only ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21 are affected, so devices on later patched builds are not exploitable. No authentication, credentials, or user interaction are needed. |
| Impact | This is a genuinely high-priority flaw rather than a CVSS-inflated one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the easiest possible access profile - and the VC:H plus SC:H metrics align with the description of arbitrary file read on the host, where SC:H reflects that the leaked files belong to the broader system beyond the vulnerable CGI itself. All signals that are present point the same direction; there is no conflict between the vector and the description (header injection in start-page-loader.cgi via the state parameter abusing X-Sendfile is consistent with AV:N/PR:N and a confidentiality-only impact). The key caveat is missing corroborating exploitation intelligence: no EPSS score, no CISA KEV listing, and no public POC are provided, so real-world exploitation velocity cannot be quantified from this data. Treat it as a high-urgency patch candidate on exposure grounds (unauthenticated remote file disclosure on an internet-facing NAS class device), while noting that active-exploitation status is unconfirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the NAS web interface sends a single crafted HTTP request to start-page-loader.cgi, injecting headers through the state parameter so that the web server's X-Sendfile mechanism returns an arbitrary file (e.g., configuration files or credential stores) in the response. Because no authentication, user interaction, or special timing is required (AV:N/AC:L/PR:N/UI:N), the attack is a straightforward one-shot request. No public exploit identified at time of analysis, but the technique is simple enough to reproduce from the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Unauthenticated arbitrary file read affects ASUSTOR ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21, where a single crafted HTTP request to start-page-loader.cgi injects headers through the state parameter and abuses the underlying web server's X-Sendfile mechanism to return the contents of sensitive files on the host. No credentials or user interaction are required and default configurations are exploitable, making internet-exposed NAS web interfaces the highest-risk deployment, while LAN-only devices require attacker network presence; the flaw is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis. The independent assessment rates this as a genuinely high-priority confidentiality-only flaw (CVSS 3.1 scope-changed, C:H/I:N/A:N; CVSS 4.0 base 9.2) rather than a CVSS-inflated one.
RemediationAI
Patch status: Patch available per vendor advisory. The authoritative fix information is the ASUSTOR security advisory at https://www.asustor.com/security/security_advisory_detail?id=71; the input data does not specify an exact fixed firmware version, so administrators should obtain the patched ADM build for their device from ASUSTOR rather than inferring a version number, and upgrade any NAS running ADM 4.1.0-4.3.3.RWC1 or 5.0.0-5.1.4.RL21. If immediate patching is not possible, the most effective compensating control is to stop exposing the ADM web interface to untrusted networks: block inbound TCP access to the ADM management/web ports at the perimeter firewall or router and require access through VPN or a trusted LAN, accepting that this removes remote administrative and user access to the NAS UI. Additionally, a reverse proxy or WAF in front of ADM can be configured to reject requests to start-page-loader.cgi whose state parameter contains encoded CRLF sequences (%0d%0a or literal \r\n), which blocks the injection path while leaving legitimate start-page functionality intact but adds latency and requires rule maintenance. Disabling the web server's X-Sendfile/X-Accel-Redirect capability would also neutralize the file-delivery step, with the trade-off that legitimate file-download functionality in the ADM web UI may break. Finally, review ADM web server logs for anomalous requests to start-page-loader.cgi containing suspicious state parameter values as a detection measure; this is monitoring only and does not prevent exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers, i.e. HTTP header injection/response splitting) in the ADM web application's start-page-loader.cgi CGI handler. The state parameter accepts attacker-supplied input that is not sanitized for carriage-return/line-feed sequences, allowing an unauthenticated remote client to inject arbitrary HTTP headers into the CGI response. The injected header targets the web server's X-Sendfile-style file-delivery mechanism (the mod_xsendfile/X-Accel-Redirect pattern used by the HTTP daemon on the NAS), so the server itself reads and returns the attacker-chosen path as the response body, bypassing the CGI script's own access controls. The vulnerability is reachable pre-authentication because the start-page loader is served before login. The CPE cpe:2.3:a:asustor_inc.:adm:*:*:*:*:*:*:*:* confirms ASUSTOR Data Master (ADM) is the affected product rather than a standalone application component, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) plus the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) agree that exploitation is network-vector, unauthenticated, no user interaction, no integrity or availability impact, and that the scope is changed with high confidentiality impact on both the vulnerable system and subsequent systems - consistent with reading files owned by the web server user beyond the ADM application itself.
Know when Adm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Unauthenticated network request (AV:N/AC:L/PR:N/UI:N) reads host files beyond the CGI's authority so scope changes (S:C) with high confidentiality impact only; no integrity or availability effect.
Primary rating from Vendor (ASUSTOR1).
CVSS VectorVendor: ASUSTOR1
DescriptionCVE.org
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.
Executive ViewAI
ASUSTOR ADM versions 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21 are affected by a critical confidentiality flaw that can expose sensitive files stored on NAS devices, particularly those with internet-facing management interfaces. Because default configurations are vulnerable and no vendor-released patch has been identified, organizations relying on these devices for backups, file sharing, or credentials face potential data leakage until exposure is removed or mitigations are deployed. No public exploit identified at time of analysis, but leadership should prioritize immediate attack-surface reduction and monitoring.
No vendor-released patch identified at time of analysis; interim mitigations include removing internet exposure, restricting ADM management to trusted VPN/LAN, blocking or restricting access to start-page-loader.cgi, deploying WAF/IPS rules to detect state-parameter header injection and X-Sendfile abuse, segmenting NAS from sensitive networks, monitoring logs for anomalous file-read requests, and rotating secrets stored on affected devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/
EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory st
A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size vali
Remote code execution in ASUSTOR ADM (ASUSTOR Data Master) operating system versions 4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.RE
A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validati
Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating
Remote code execution in ASUSTOR ADM (4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1) allows authenticated high-privilege attacke
Path traversal in the IHM Log handling of ASUSTOR ADM (the operating system for ASUSTOR NAS appliances) lets an authenti
Arbitrary file write in the VPN Client component of ASUSTOR ADM (the ADM NAS operating system) lets an authenticated, hi
Path traversal in the Wallpaper component of ASUSTOR Data Master (ADM) exposes arbitrary files to authenticated high-pri
A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. Rated medium severity (CVSS 6
Exploit-DB