What is the CVSS score of CVE-2026-3179?

CVE-2026-3179 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Data Master are affected by CVE-2026-3179?

A critical vulnerability in FTP Backup functionality on ADM systems allows attackers to write malicious files outside intended directories, potentially compromising system integrity and enabling…

How to fix or mitigate CVE-2026-3179?

Within 24 hours: disable FTP Backup feature on all ADM systems or restrict FTP connections to trusted internal servers only. Within 7 days: conduct inventory of all ADM instances with FTP Backup enabled and audit recent backup logs for suspicious file writes. Within 30 days: implement network segmentation to isolate ADM systems, monitor vendor advisories for patch availability, and establish secure alternative backup mechanisms.

Data Master CVE-2026-3179

HIGH

Path Traversal (CWE-22)

2026-02-25 security@asustor.com

RCE Privilege Escalation Path Traversal Data Master

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 25, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write files outside the intended backup directory. A path traversal vulnerability may allow an attacker to overwrite arbitrary files on the system and potentially achieve privilege escalation or remote code execution. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.2.RE51.

AnalysisAI

Arbitrary file write vulnerability in Data Master ADM versions 4.1.0-4.3.3.ROF1 and 5.0.0-5.1.2.RE51 allows remote or man-in-the-middle attackers to bypass filename sanitization in FTP backup operations and place malicious files outside the intended directory. An attacker can exploit this path traversal flaw to overwrite critical system files and potentially execute code with elevated privileges. No patch is currently available, and exploitation requires moderate attack complexity but no user interaction.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Data Master. The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write files outside the intended backup directory. A path traversal vulnerability may allow an attacker to overwrite arbitrary files on the system and potentially achieve privilege escalation or remote code execution. Affected products and versions include: fr

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.