Asustor vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-105324 An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system.Critical 9.2 · Oct 6, 2026
• CVE-2026-18759 The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encrypHigh 8.5 · Aug 4, 2026
• CVE-2026-67248 A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM.High 8.7 · Jul 30, 2026
• CVE-2026-67247 A path traversal vulnerability was found in the IHM Log handling of ADM.High 7.1 · Jul 30, 2026
• CVE-2026-67245 A path traversal vulnerability was found in the VPN Clients on the ADM.High 7 · Jul 30, 2026
• CVE-2026-67244 A format string vulnerability was found in the Notification OAuth settings of ADM.High 8.6 · Jul 29, 2026
• CVE-2026-18188 A format string vulnerability was found in the Rsync Backup on the ADM.High 7.1 · Jul 29, 2026
• CVE-2026-18187 A format string vulnerability was found in the Internal Backup on the ADM.High 7.1 · Jul 29, 2026
• CVE-2026-18186 A stored format string vulnerability was found in the FTP Backup on the ADM.High 7.1 · Jul 29, 2026
• CVE-2026-6644 A command injection vulnerability was found in the PPTP VPN Clients on the ADM.Critical 9.4 · Apr 20, 2026
• CVE-2026-6643 A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM.High 8.6 · Apr 20, 2026
• CVE-2026-3179 The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings.Critical 9.2 · Feb 25, 2026
• CVE-2026-3100 The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS.High 8.3 · Feb 25, 2026
• CVE-2026-24936 When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowingCritical 9.5 · Feb 2, 2026
• CVE-2026-24933 The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server.High 8.9 · Feb 2, 2026
• CVE-2026-24932 The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate.High 8.9 · Feb 2, 2026
• CVE-2025-13053 When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept neHigh 7 · Dec 11, 2025
• CVE-2025-13052 When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can iHigh 7 · Dec 11, 2025
• CVE-2025-13051 When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as oCritical 9.3 · Nov 18, 2025
• CVE-2025-8070 The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability.Critical 9.2 · Jul 23, 2025
• CVE-2025-7699 An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server fileHigh 7.1 · Jul 16, 2025
• CVE-2023-4475 An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to unintenHigh 7.5 · Aug 22, 2023
• CVE-2023-3699 An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configuraHigh 8.7 · Aug 22, 2023
• CVE-2023-3698 Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and delete fileHigh 8.5 · Aug 17, 2023
• CVE-2023-3697 Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create fileHigh 8.5 · Aug 17, 2023