Adm EUVD-2026-23786

Requires authenticated access with high privileges (administrative credentials) to the ASUSTOR ADM web interface. Specifically, the attacker must access VPN client configuration functionality, which is typically restricted to administrator roles in ADM. Attack is network-based (AV:N) with low complexity (AC:L), meaning no special timing, race conditions, or non-default configurations are required beyond the privilege requirement. Default ADM installations with VPN client features available are exploitable once the authentication barrier is crossed. Exploitation is limited by the PR:H requirement-attackers must first obtain admin credentials through phishing, credential stuffing, or exploitation of separate authentication vulnerabilities. No user interaction (UI:N) is required after authentication, enabling scripted exploitation in compromised environments.

CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with network attack vector (AV:N) and low complexity (AC:L), but critically requires high privileges (PR:H) and affects subsequent systems with low impact (SC:L/SI:L/SA:L). The PR:H requirement significantly constrains real-world risk-attackers need existing administrative credentials, limiting this to insider threats, credential compromise chains, or lateral movement scenarios. SSVC framework confirms exploitation is not automatable and requires privileged context, reducing weaponization potential. EPSS score of 0.23% (below median) indicates security researchers assess mass exploitation as unlikely, consistent with the authentication barrier. No CISA KEV listing and no public POC further support low immediate threat. However, the technical impact rating of 'total' means successful exploitation grants complete system control. This is a classic high-severity-but-moderate-priority issue: devastating if exploited, but exploitation requires significant attacker positioning. Priority should increase in environments with: (1) exposed ADM management interfaces, (2) shared administrative access, or (3) evidence of credential compromise. The absence of basic memory protections (PIE/canaries) in a 2026 product is concerning from a secure development lifecycle perspective.

An attacker with compromised high-privilege ADM credentials accesses the web management interface and navigates to VPN client configuration. By submitting specially crafted VPN connection parameters containing oversized strings with embedded format specifiers, the attacker triggers the stack buffer overflow in sscanf() processing, simultaneously exploiting the printf() format string weakness. The overflow overwrites stack return addresses with attacker-controlled values, redirecting execution to injected shellcode. Since PIE and stack canaries are absent, the attacker reliably calculates memory layout and detects no runtime protections. Code executes with web server privileges, allowing the attacker to install persistent backdoors, exfiltrate NAS data, or pivot to connected network segments.