ASUSTOR ADM CVE-2026-67246

Exploitation requires an authenticated session with high-privilege (administrator-level) access to the ASUSTOR ADM web interface, as confirmed by the CVSS 4.0 PR:H metric. The Wallpaper component must be reachable by the attacker - either via direct LAN access or a remotely exposed management interface. The vulnerability is limited to confidentiality impact only (file read); the CVSS VC:H/VI:N/VA:N metrics confirm no write or denial-of-service capability. File access is further constrained by the OS-level user permissions of the ADM process and filesystem ACLs, meaning not all files are necessarily readable. Exploitation is NOT possible by unauthenticated or low-privileged users - an attacker who cannot obtain high-privileged ADM credentials cannot exploit this vulnerability regardless of network access.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N reflects a meaningful but access-gated risk. The PR:H requirement is the dominant limiting factor: an attacker must already hold high-privileged (administrator-level) credentials to the ADM web interface, substantially narrowing the realistic threat actor pool to insiders, compromised admin accounts, or attackers who have separately obtained credentials. For those who do meet that bar, exploitation is low-complexity and fully remote, and the VC:H impact means sensitive NAS filesystem content - including configuration files, stored credentials, or user data - may be exposed. No KEV listing and no public exploit have been identified, so opportunistic mass exploitation is not a current concern. EPSS data is absent from the provided intelligence, but given the PR:H prerequisite and niche product footprint, probability of widespread exploitation is assessed as low. This is a real-but-conditional priority: organizations using ASUSTOR ADM in multi-tenant or internet-exposed configurations, or where NAS admin credentials may be shared, should treat patching as time-sensitive.

An attacker with administrator-level access to an ASUSTOR NAS management interface authenticates to ADM and navigates to the Wallpaper customization component. They submit a crafted wallpaper path such as '../../../../etc/shadow' or a path targeting NAS configuration directories. The server processes the traversal sequence without adequate sanitization and returns file content from outside the intended wallpaper directory, allowing the attacker to read sensitive OS or application files subject to the NAS process's filesystem permissions. No public proof-of-concept has been identified, but the technique is well-understood and trivially reproducible by any competent attacker with valid admin credentials.