EUVD-2026-50965
GHSA-phvr-wwmj-5cr2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege ADM credentials
-
DeliveryReach File Explorer CGI over network
-
ExploitSend oversized crafted decoded input
-
ExecutionOverflow fixed stack buffer
-
ImpactCrash CGI process (potential code execution)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated ADM account (CVSS PR:L) with access to the File Explorer feature, and network reachability to the ADM web/CGI interface (AV:N, AC:L, no user interaction). The specific prerequisite is sending crafted user-controlled input to the File Explorer CGI that is decoded and copied into a fixed-size stack buffer. Limiting factors: the attacker must first hold credentials (not unauthenticated), the affected ADM version must be in the 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81 ranges, and the interface must be reachable - meaning internet-exposed NAS units with weak or shared accounts are the realistic at-risk population; impact beyond denial of service further depends on defeating runtime protections such as stack canaries and ASLR. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 by treating the outcome as full compromise, but the description only confirms denial of service and explicitly hedges further impact as dependent on exploitability and runtime protections - a notable divergence between the scored impact and the confirmed impact. PR:L means an attacker needs valid (low-privilege) credentials, which meaningfully limits opportunistic mass exploitation compared to an unauthenticated flaw. There is no EPSS score, no POC, and no KEV listing provided, so all real-world-exploitation signals are currently absent; this reads as a credentialed-attacker or post-authentication concern rather than an internet-wide worm risk. Bottom line: confirmed impact is a crash of the CGI process; RCE is plausible for a stack overflow but unproven, so the 8.7 should be treated as a worst-case ceiling pending exploitability confirmation. |
| Exploit ScenarioDerived | An attacker who has obtained or been granted a low-privilege ADM account authenticates to the web interface and sends a File Explorer request containing an overlong crafted value that, once decoded, exceeds the fixed stack buffer, overflowing it and crashing the CGI process to deny service to legitimate users. With favorable memory layout and weak runtime protections, the same overflow could in principle be developed into code execution, though no public POC currently demonstrates this. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory - upgrade ADM to the fixed release beyond the affected 4.3.3.RUN1 / 5.1.3.RI81 branches as directed at the ASUSTOR advisory https://www.asustor.com/security/security_advisory_detail?id=69 (the exact fixed build is not specified in the provided data, so confirm the target version there before updating). As compensating controls until patched: restrict access to the ADM web administration and File Explorer interface to trusted management networks or a VPN rather than exposing it to the internet, which removes the network reachability the attack depends on (trade-off: remote users lose direct browser access); tighten and audit low-privilege accounts and disable or remove unused File Explorer-enabled users, since exploitation requires authentication (PR:L); and monitor for repeated CGI process crashes as an indicator of exploitation attempts. Avoid exposing NAS management ports directly to WAN.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ADM (ASUSTOR Data Master) is the Linux-based network-attached-storage (NAS) operating system running on ASUSTOR appliances, exposing a web administration interface backed by CGI programs. The flaw is a classic CWE-121 stack-based buffer overflow: user-controlled input reaching the File Explorer feature is decoded (the advisory language implies URL/percent or similar decoding that can expand input length) and then copied into a fixed-size stack buffer without validating the resulting length, allowing the return address and saved registers on the stack to be overwritten. The affected component is a CGI process, so the overflow occurs in a native binary invoked by the web server. The single CPE cpe:2.3:a:asustor_inc.:adm:*:*:*:*:*:*:*:* confirms ADM itself as the affected product rather than a bundled third-party library.
Know when Adm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable CGI needs low-priv auth (PR:L) with no interaction; DoS is confirmed (A:H) while confidentiality/integrity impact is only potential, so C:L/I:L rather than H.
Primary rating from Vendor (ASUSTOR1).
CVSS VectorVendor: ASUSTOR1
DescriptionCVE.org
A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial of service of the affected CGI process. Further impact may be possible depending on exploitability and runtime protections. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.
Executive ViewAI
ASUSTOR ADM storage systems (versions 4.1.0 through 5.1.3) are exposed to a denial-of-service vulnerability triggered by authenticated network users; no public exploit code has been published. This poses immediate operational risk for organizations relying on these NAS appliances for shared storage. No vendor patch is currently available, requiring prompt interim controls.
Restrict network access to ADM File Explorer to only authenticated administrative users; enforce multi-factor authentication for all ADM administrative credentials; implement comprehensive logging and monitoring of authenticated connections; isolate ADM systems through network segmentation to minimize exposure from untrusted user populations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/
EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory st
A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size vali
Remote code execution in ASUSTOR ADM (ASUSTOR Data Master) operating system versions 4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.RE
Unauthenticated arbitrary file read affects ASUSTOR ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21, where a s
A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validati
Remote code execution in ASUSTOR ADM (4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1) allows authenticated high-privilege attacke
Path traversal in the IHM Log handling of ASUSTOR ADM (the operating system for ASUSTOR NAS appliances) lets an authenti
Arbitrary file write in the VPN Client component of ASUSTOR ADM (the ADM NAS operating system) lets an authenticated, hi
Path traversal in the Wallpaper component of ASUSTOR Data Master (ADM) exposes arbitrary files to authenticated high-pri
A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. Rated medium severity (CVSS 6
Exploit-DB