ASUSTOR ADM CVE-2026-67245

Exploitation requires an authenticated session with high privileges on ADM (CVSS PR:H) and access to the VPN Client certificate upload feature, which must be reachable to the attacker; the attacker abuses the certificate NAME field specifically to inject path-traversal sequences into the upload destination path. Success is further bounded by the ADM process privileges and filesystem permissions explicitly noted in the description - the write only lands where those permissions allow, so it is not an unconstrained root-level overwrite. Limiting factors: no anonymous/low-privilege path (PR:H), functionality only exposed if the VPN Client feature is present/used, and impact is integrity/availability rather than data disclosure (VC:N).

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H) scores 7.0 (High) and describes a network-reachable, low-complexity attack that nonetheless requires high privileges (PR:H) and yields integrity and availability impact with no confidentiality loss - consistent with an authenticated file-write primitive. The PR:H requirement is the dominant limiting factor: the attacker must already hold an administrative/high-privilege ADM account, which sharply narrows the realistic threat to insiders, credential-theft scenarios, or chaining from a separate authentication bypass. No EPSS score, KEV listing, POC, or SSVC data was provided, so exploitation likelihood cannot be quantified from the inputs; the absence of a KEV entry and any public exploit suggests this is not currently mass-exploited. Net: a genuine but not top-tier priority - meaningful for hardened/multi-user NAS deployments, lower urgency where admin access is tightly controlled.

An attacker who has obtained high-privilege ADM credentials (e.g., a rogue administrator or via stolen/reused admin login) navigates to the VPN Client certificate upload function and submits a certificate whose name embeds traversal sequences. The crafted name causes the uploaded file to be written outside the VPN certificate directory - for example overwriting a configuration or script location - enabling tampering or disruption within the limits of the ADM process privileges and filesystem permissions.