Which versions of ASUSTOR ADM are affected by EUVD-2026-50964?

ASUSTOR ADM, the operating system powering ASUSTOR NAS appliances, contains a path traversal vulnerability that allows authenticated users to access unintended filesystem paths and sensitive log…

How to fix or mitigate EUVD-2026-50964?

Within 24 hours, inventory all ASUSTOR ADM systems running versions 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81 and classify them by business criticality; disable network access to non-critical systems or take them offline immediately. Within 7 days, for systems that must remain in service, restrict network access to trusted administrative networks only, audit and enforce least-privilege access for all user accounts, and enable audit logging to monitor filesystem access patterns. Within 30 days, subscribe to ASUSTOR security advisories for patch availability updates, establish a timeline and test environment for patching upon release, and develop contingency plans including alternative storage vendors if patch timelines extend beyond organizational risk tolerance (>90 days).

ASUSTOR ADM EUVD-2026-50964

Q: What is the CVSS score of EUVD-2026-50964?

EUVD-2026-50964 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-67247 HIGH

Path Traversal (CWE-22)

2026-07-30 ASUSTOR1

GHSA-44gq-p8gp-qh7f

Path Traversal Adm Asustor Inc

7.1

CVSS 4.0 · Vendor: ASUSTOR1

Severity by source

Vendor (ASUSTOR1) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable, low-complexity, authenticated (PR:L) traversal with no user interaction; confidentiality-only file disclosure so C:H and I:N/A:N, matching the vendor 4.0 vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ASUSTOR1).

CVSS VectorVendor: ASUSTOR1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 04:51 vuln.today

CVE Published

Jul 30, 2026 - 03:42 cve.org

HIGH 7.1

DescriptionCVE.org

A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause the affected component to access an unintended filesystem path or log database file. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

AnalysisAI

Path traversal in the IHM Log handling of ASUSTOR ADM (the operating system for ASUSTOR NAS appliances) lets an authenticated attacker manipulate the disk-serial input used to build an IHM log database file path, redirecting the component to read an unintended filesystem path or log database. The CVSS 4.0 score is 7.1 with a confidentiality-only impact and no public exploit identified at time of analysis. Affected releases span ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81.

Technical ContextAI

ADM (ASUSTOR Data Master) is the Linux-based NAS operating system shipping on ASUSTOR network-attached storage devices, identified by CPE cpe:2.3:a:asustor_inc.:adm. The flaw is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal) issue: the IHM (health/hardware monitoring) logging subsystem takes a disk serial number as input and concatenates it into the on-disk path of a log database file. Because that serial-derived value is not sufficiently sanitized, traversal sequences (e.g. ../) or crafted values can escape the intended log directory, causing the component to open a file outside its expected scope.

RemediationAI

Consult the ASUSTOR security advisory at https://www.asustor.com/security/security_advisory_detail?id=68 and upgrade ADM to a fixed release beyond the affected ranges (past 4.3.3.RUN1 on the 4.x branch and past 5.1.3.RI81 on the 5.x branch); no exact fixed version string is included in the provided data, so treat the advisory as authoritative - patch available per vendor advisory. Until patched, reduce exposure by restricting who holds authenticated ADM accounts and enforcing least privilege, and avoid exposing the ADM management interface directly to the internet by placing it behind a VPN or restricting access by source IP, accepting the trade-off of less convenient remote administration. Because exploitation is authenticated, tightening account provisioning and monitoring IHM/log-subsystem access for anomalous disk-serial values are practical compensating controls.