Asustor Inc
Monthly
ASUSTOR Backup Plan (ABP) and EZSync (AES) background services run as NT AUTHORITY\SYSTEM and expose a file-based IPC channel whose AES encryption key is readable by standard users and recoverable via Windows DPAPI, allowing any authenticated local account to forge valid service requests. The services further fail to verify the identity of the requesting process and validate filesystem paths using an insufficient substring check, enabling directory traversal sequences to bypass path restrictions. A local attacker can chain these weaknesses to perform arbitrary file reads and writes as SYSTEM, achieving full local privilege escalation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in the IHM Log handling of ASUSTOR ADM (the operating system for ASUSTOR NAS appliances) lets an authenticated attacker manipulate the disk-serial input used to build an IHM log database file path, redirecting the component to read an unintended filesystem path or log database. The CVSS 4.0 score is 7.1 with a confidentiality-only impact and no public exploit identified at time of analysis. Affected releases span ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81.
Arbitrary file write in the VPN Client component of ASUSTOR ADM (the ADM NAS operating system) lets an authenticated, high-privileged attacker place uploaded certificate files outside the intended VPN certificate directory. The flaw stems from insufficient validation of the user-supplied certificate name when building the upload destination path, enabling directory traversal (CWE-22). No public exploit identified at time of analysis; the issue is not listed in CISA KEV and no POC is referenced.
Remote code execution in ASUSTOR ADM (ASUSTOR Data Master) operating system versions 4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1 allows authenticated administrators to inject arbitrary OS commands via the PPTP VPN Clients web interface. The command injection (CWE-78) bypasses the restricted web environment, enabling full system compromise. Attack complexity is low (AC:L) with network attack vector (AV:N), and CVSS 9.4 reflects critical impact across confidentiality, integrity, and availability. No active exploitation or public POC confirmed at time of analysis, though EPSS probability data not available.
Remote code execution in ASUSTOR ADM (4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1) allows authenticated high-privilege attackers to execute arbitrary code via stack-based buffer overflow in VPN client components. The vulnerability combines unbounded sscanf() calls with format string weaknesses (printf with user-controlled data), exploitable due to absent PIE and stack canary protections. EPSS exploitation probability is low (0.23%, 46th percentile) with no public exploit code identified at time of analysis, suggesting limited real-world targeting despite high CVSS score.
Path traversal in the Wallpaper component of ASUSTOR Data Master (ADM) exposes arbitrary files to authenticated high-privileged attackers across two separate version branches. Affected NAS appliances running ADM 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81 allow an attacker who controls an admin-level account to submit crafted wallpaper path inputs containing traversal sequences, escaping the intended directory and reading files restricted only by the underlying OS user permissions. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the realistic attacker population.
ASUSTOR Backup Plan (ABP) and EZSync (AES) background services run as NT AUTHORITY\SYSTEM and expose a file-based IPC channel whose AES encryption key is readable by standard users and recoverable via Windows DPAPI, allowing any authenticated local account to forge valid service requests. The services further fail to verify the identity of the requesting process and validate filesystem paths using an insufficient substring check, enabling directory traversal sequences to bypass path restrictions. A local attacker can chain these weaknesses to perform arbitrary file reads and writes as SYSTEM, achieving full local privilege escalation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in the IHM Log handling of ASUSTOR ADM (the operating system for ASUSTOR NAS appliances) lets an authenticated attacker manipulate the disk-serial input used to build an IHM log database file path, redirecting the component to read an unintended filesystem path or log database. The CVSS 4.0 score is 7.1 with a confidentiality-only impact and no public exploit identified at time of analysis. Affected releases span ADM 4.1.0 through 4.3.3.RUN1 and ADM 5.0.0 through 5.1.3.RI81.
Arbitrary file write in the VPN Client component of ASUSTOR ADM (the ADM NAS operating system) lets an authenticated, high-privileged attacker place uploaded certificate files outside the intended VPN certificate directory. The flaw stems from insufficient validation of the user-supplied certificate name when building the upload destination path, enabling directory traversal (CWE-22). No public exploit identified at time of analysis; the issue is not listed in CISA KEV and no POC is referenced.
Remote code execution in ASUSTOR ADM (ASUSTOR Data Master) operating system versions 4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1 allows authenticated administrators to inject arbitrary OS commands via the PPTP VPN Clients web interface. The command injection (CWE-78) bypasses the restricted web environment, enabling full system compromise. Attack complexity is low (AC:L) with network attack vector (AV:N), and CVSS 9.4 reflects critical impact across confidentiality, integrity, and availability. No active exploitation or public POC confirmed at time of analysis, though EPSS probability data not available.
Remote code execution in ASUSTOR ADM (4.1.0-4.3.3.RR42 and 5.0.0-5.1.2.REO1) allows authenticated high-privilege attackers to execute arbitrary code via stack-based buffer overflow in VPN client components. The vulnerability combines unbounded sscanf() calls with format string weaknesses (printf with user-controlled data), exploitable due to absent PIE and stack canary protections. EPSS exploitation probability is low (0.23%, 46th percentile) with no public exploit code identified at time of analysis, suggesting limited real-world targeting despite high CVSS score.
Path traversal in the Wallpaper component of ASUSTOR Data Master (ADM) exposes arbitrary files to authenticated high-privileged attackers across two separate version branches. Affected NAS appliances running ADM 4.1.0-4.3.3.RUN1 or 5.0.0-5.1.3.RI81 allow an attacker who controls an admin-level account to submit crafted wallpaper path inputs containing traversal sequences, escaping the intended directory and reading files restricted only by the underlying OS user permissions. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the realistic attacker population.