ASUSTOR ADM CVE-2026-67247

Requires an authenticated ADM session (CVSS PR:L) and network reachability to the ADM device (AV:N); no user interaction is needed (UI:N) and the attack is low-complexity (AC:L). The specific trigger is supplying attacker-controlled disk-serial input to the IHM log handling feature, which uses that value to construct the IHM log database file path. Exploitation is limited to affected versions (ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81) and is bounded by the confidentiality-only impact (VC:H, VI:N, VA:N) - the flaw enables reading/redirecting to unintended files, not modifying or crashing the system, and the attacker must first obtain valid low-privileged credentials.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, 7.1) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, with a high confidentiality impact but no integrity or availability impact - consistent with a read-oriented traversal where an authenticated user can disclose data but cannot write or crash the system. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied, so current real-world exploitation pressure appears low. The main tension is the VC:H rating versus a description that only mentions accessing an 'unintended filesystem path or log database file' - the actual breadth of readable data (arbitrary files vs. only other database files) is not spelled out, so whether this yields high-value secret disclosure should be verified against the vendor advisory. Net: a genuine but authentication-gated information-disclosure issue, mid-tier priority, not an unauthenticated critical.

An attacker who already holds a low-privileged authenticated session on a network-reachable ADM device submits a crafted disk-serial value containing traversal sequences to the IHM log handling routine, causing it to open a log database file outside the intended directory and disclose its contents. Given AC:L and no user interaction required, the request is simple to automate; however, no public proof-of-concept has been identified at time of analysis.