https://vulnogram.org/ Most recent CVEs assigned by asustor1 (asustor1). https://vulnogram.org/seaview/icons/asustor1.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-105324 https://vulnogram.org/CVE-2026-105324 An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker… Critical Network Exploitable Wed, 07 Oct 2026 01:12:26 GMT https://vulnogram.org/CVE-2026-18759 https://vulnogram.org/CVE-2026-18759 The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DP… High Tue, 04 Aug 2026 07:25:09 GMT https://vulnogram.org/CVE-2026-67248 https://vulnogram.org/CVE-2026-67248 A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated a… High Thu, 30 Jul 2026 03:48:04 GMT https://vulnogram.org/CVE-2026-67247 https://vulnogram.org/CVE-2026-67247 A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenti… High Thu, 30 Jul 2026 03:42:58 GMT https://vulnogram.org/CVE-2026-67246 https://vulnogram.org/CVE-2026-67246 A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit t… Medium Thu, 30 Jul 2026 03:33:52 GMT https://vulnogram.org/CVE-2026-67245 https://vulnogram.org/CVE-2026-67245 A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path. An authenticated… High Thu, 30 Jul 2026 03:29:03 GMT https://vulnogram.org/CVE-2026-67244 https://vulnogram.org/CVE-2026-67244 A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administ… High Thu, 30 Jul 2026 03:04:16 GMT https://vulnogram.org/CVE-2026-18188 https://vulnogram.org/CVE-2026-18188 A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data may be processed through an unsafe format string operation. An authenticated attacker can… High Thu, 30 Jul 2026 02:59:08 GMT https://vulnogram.org/CVE-2026-18187 https://vulnogram.org/CVE-2026-18187 A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an error response and processed through an unsafe format string operation. An authenticated atta… High Thu, 30 Jul 2026 02:54:45 GMT https://vulnogram.org/CVE-2026-18186 https://vulnogram.org/CVE-2026-18186 A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An a… High Thu, 30 Jul 2026 02:44:33 GMT https://vulnogram.org/CVE-2026-6644 https://vulnogram.org/CVE-2026-6644 A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs… Critical Mon, 20 Apr 2026 06:54:42 GMT https://vulnogram.org/CVE-2026-6643 https://vulnogram.org/CVE-2026-6643 A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an aut… High Mon, 20 Apr 2026 06:34:27 GMT https://vulnogram.org/CVE-2026-3179 https://vulnogram.org/CVE-2026-3179 The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write file… Critical Network Exploitable Wed, 25 Feb 2026 05:55:07 GMT https://vulnogram.org/CVE-2026-3100 https://vulnogram.org/CVE-2026-3100 The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper validated TLS/SSL certificates allows a remote attacker can intercept network traffic to perform… High Network Exploitable Wed, 25 Feb 2026 05:52:20 GMT https://vulnogram.org/CVE-2026-24936 https://vulnogram.org/CVE-2026-24936 When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By… Critical Network Exploitable Tue, 03 Feb 2026 03:50:18 GMT https://vulnogram.org/CVE-2026-24935 https://vulnogram.org/CVE-2026-24935 A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or red… Medium Network Exploitable Tue, 03 Feb 2026 02:28:56 GMT https://vulnogram.org/CVE-2026-24934 https://vulnogram.org/CVE-2026-24934 The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoo… Medium Network Exploitable Tue, 03 Feb 2026 02:26:55 GMT https://vulnogram.org/CVE-2026-24933 https://vulnogram.org/CVE-2026-24933 The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificates validation vulnerability allows an unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) at… High Network Exploitable Tue, 03 Feb 2026 02:22:01 GMT https://vulnogram.org/CVE-2026-24932 https://vulnogram.org/CVE-2026-24932 The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improper validated TLS/SSL certificates allows a remote attacker can intercept the communication… High Network Exploitable Tue, 03 Feb 2026 02:19:41 GMT https://vulnogram.org/CVE-2025-13053 https://vulnogram.org/CVE-2025-13053 When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept network traffic between the client and server can perform a man-in-the-middle (MITM) attack,… High Network Exploitable Fri, 12 Dec 2025 02:46:08 GMT https://vulnogram.org/CVE-2025-13052 https://vulnogram.org/CVE-2025-13052 When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can intercept network traffic between the SMTP client and server to execute a man-in-the-middle… High Network Exploitable Fri, 12 Dec 2025 02:30:35 GMT https://vulnogram.org/CVE-2025-13051 https://vulnogram.org/CVE-2025-13051 When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the service. Upon service restart, the malicious DLL is loaded and executed u… Critical Wed, 19 Nov 2025 02:50:57 GMT https://vulnogram.org/CVE-2025-8070 https://vulnogram.org/CVE-2025-8070 The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. I… Critical Wed, 23 Jul 2025 07:26:03 GMT https://vulnogram.org/CVE-2025-7699 https://vulnogram.org/CVE-2025-7699 An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server file system into their own EZSync folder. The vulnerability is due to a lack of authorization c… High Wed, 16 Jul 2025 09:41:12 GMT https://vulnogram.org/CVE-2025-7618 https://vulnogram.org/CVE-2025-7618 A stored Cross-Site Scripting (XSS) vulnerability vulnerability was found in the File Explorer and Text Editor of ADM. An attacker could exploit this vulnerability to inject malicious scripts into the applications, which may then access cookies or ot… Medium Mon, 14 Jul 2025 10:15:10 GMT https://vulnogram.org/CVE-2025-7380 https://vulnogram.org/CVE-2025-7380 A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to inject malicious scripts into the folder name field while creating a new shared folder. These scripts are not properly sanitized an… Medium Mon, 14 Jul 2025 05:39:07 GMT https://vulnogram.org/CVE-2025-7379 https://vulnogram.org/CVE-2025-7379 A security bypass vulnerability allows exploitation via Reverse Tabnabbing, a type of phishing attack where attackers can manipulate the content of the original tab, leading to credential theft and other security risks. This issue affects DataSync Ce… Medium Wed, 09 Jul 2025 08:31:02 GMT https://vulnogram.org/CVE-2025-7378 https://vulnogram.org/CVE-2025-7378 An improper Input Validation vulnerability allows injecting arbitrary values of the NAS configuration file in ASUSTOR ADM. This could potentially lead to system misconfiguration and break the format of the configuation file, causing the NAS to exhibi… Medium Wed, 09 Jul 2025 07:06:08 GMT https://vulnogram.org/CVE-2023-4475 https://vulnogram.org/CVE-2023-4475 An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to unintended directories. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below a… High Tue, 22 Aug 2023 09:02:30 GMT https://vulnogram.org/CVE-2023-3699 https://vulnogram.org/CVE-2023-3699 An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as A… High Tue, 22 Aug 2023 08:57:21 GMT https://vulnogram.org/CVE-2023-3698 https://vulnogram.org/CVE-2023-3698 Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM… High Thu, 17 Aug 2023 09:34:53 GMT https://vulnogram.org/CVE-2023-3697 https://vulnogram.org/CVE-2023-3697 Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM… High Thu, 17 Aug 2023 09:33:46 GMT https://vulnogram.org/CVE-2023-2910 https://vulnogram.org/CVE-2023-2910 Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM) allows remote unauthorized users to execute arbitrary commands via unspecified vectors. Af… High Thu, 17 Aug 2023 09:25:43 GMT https://vulnogram.org/CVE-2023-2909 https://vulnogram.org/CVE-2023-2909 EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and be… High Wed, 31 May 2023 09:26:31 GMT https://vulnogram.org/CVE-2023-2749 https://vulnogram.org/CVE-2023-2749 Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM… High Network Exploitable Wed, 31 May 2023 08:36:37 GMT https://vulnogram.org/CVE-2023-2509 https://vulnogram.org/CVE-2023-2509 A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. An attacker can exploit this vulnerability to inject malicious scripts into the target applications to access any cookies or sensitive information retained by… High Wed, 17 May 2023 06:33:37 GMT https://vulnogram.org/CVE-2023-30770 https://vulnogram.org/CVE-2023-30770 A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation. An attacker can exploit this vulnerability to execute arbitrary code. Affected ADM versions include: 4.0.6.REG2, 4.1.0 and… High Mon, 17 Apr 2023 06:32:05 GMT https://vulnogram.org/CVE-2022-37398 https://vulnogram.org/CVE-2022-37398 A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can exploit this vulnerability to run arbitrary code. Affected ADM versions include: 3.5.9.RUE3 and below, 4.0.5.R… High Fri, 05 Aug 2022 16:46:19 GMT