Which versions of ASUSTOR ADM are affected by CVE-2026-67248?

ASUSTOR ADM storage systems (versions 4.1.0 through 5.1.3) are exposed to a denial-of-service vulnerability triggered by authenticated network users; no public exploit code has been published.

How to fix or mitigate CVE-2026-67248?

Within 24 hours: conduct a complete inventory of all ASUSTOR ADM systems running versions 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81 and restrict network access to the File Explorer component to only required administrative accounts. Within 7 days: implement enhanced logging and monitoring across affected systems to detect authenticated access anomalies and potential exploitation attempts; routinely check ASUSTOR security advisories for patch announcements. Within 30 days: execute upgrade planning for affected ADM systems to versions beyond 5.1.3 if available and validated for your environment, or initiate procurement of alternative NAS solutions if ASUSTOR does not release a patch through standard advisory channels.

ASUSTOR ADM CVE-2026-67248

Q: What is the CVSS score of CVE-2026-67248?

CVE-2026-67248 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50965 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-30 ASUSTOR1

GHSA-phvr-wwmj-5cr2

Buffer Overflow Denial Of Service Stack Overflow Adm Asustor Inc

8.7

CVSS 4.0 · Vendor: ASUSTOR1

Severity by source

Vendor (ASUSTOR1) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Network-reachable CGI needs low-priv auth (PR:L) with no interaction; DoS is confirmed (A:H) while confidentiality/integrity impact is only potential, so C:L/I:L rather than H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ASUSTOR1).

CVSS VectorVendor: ASUSTOR1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 04:51 vuln.today

CVE Published

Jul 30, 2026 - 03:48 cve.org

HIGH 8.7

DescriptionCVE.org

A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial of service of the affected CGI process. Further impact may be possible depending on exploitability and runtime protections. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

AnalysisAI

Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

ADM (ASUSTOR Data Master) is the Linux-based network-attached-storage (NAS) operating system running on ASUSTOR appliances, exposing a web administration interface backed by CGI programs. The flaw is a classic CWE-121 stack-based buffer overflow: user-controlled input reaching the File Explorer feature is decoded (the advisory language implies URL/percent or similar decoding that can expand input length) and then copied into a fixed-size stack buffer without validating the resulting length, allowing the return address and saved registers on the stack to be overwritten. The affected component is a CGI process, so the overflow occurs in a native binary invoked by the web server. The single CPE cpe:2.3:a:asustor_inc.:adm:*:*:*:*:*:*:*:* confirms ADM itself as the affected product rather than a bundled third-party library.

RemediationAI

Patch available per vendor advisory - upgrade ADM to the fixed release beyond the affected 4.3.3.RUN1 / 5.1.3.RI81 branches as directed at the ASUSTOR advisory https://www.asustor.com/security/security_advisory_detail?id=69 (the exact fixed build is not specified in the provided data, so confirm the target version there before updating). As compensating controls until patched: restrict access to the ADM web administration and File Explorer interface to trusted management networks or a VPN rather than exposing it to the internet, which removes the network reachability the attack depends on (trade-off: remote users lose direct browser access); tighten and audit low-privilege accounts and disable or remove unused File Explorer-enabled users, since exploitation requires authentication (PR:L); and monitor for repeated CGI process crashes as an indicator of exploitation attempts. Avoid exposing NAS management ports directly to WAN.