Asustor vulnerabilities
We track 22 vulnerabilities in Asustor products across 6 products. 22 are rated high or critical, and none are known to be exploited. The most recent was published on October 7, 2026.
Latest Asustor vulnerabilities
- 9.2 Critical severity
ADM: Improper Neutralization of CRLF Sequences in HTTP Headers
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can lever
- 8.5 High severity
ABP: Improper Privilege Management
The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any a
- 8.8 High severity
ADM: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker ca
- 8.1 High severity
ADM: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path. An authenticated attacker
- 7.2 High severity
ADM: Use of Externally-Controlled Format String
A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration input may be processed through an unsafe format string operation. An authenticated administrator can
- 8.1 High severity
ADM: Use of Externally-Controlled Format String
A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data may be processed through an unsafe format string operation. An authenticated attacker can exploit th
- 8.1 High severity
ADM: Use of Externally-Controlled Format String
A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an error response and processed through an unsafe format string operation. An authenticated attacker can e
- 8.1 High severity
ADM: Use of Externally-Controlled Format String
A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticat
- 9.1 Critical severity
ADM: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted web environment and execute arbitrary code on the underlying operating system. This occurs due to ins
- 9.9 Critical severity
ADM: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-controlled data directly to printf(). Due to the lack of PIE and Stack Canary protections, an authenticated
- 8.1 High severity
ADM: Improper Limitation of a Pathname to a Restricted Directory
The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write files outside
- 9.8 Critical severity
When a specific function is enabled while joining a AD Domain from ADM, an improper input…
When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting
- 9.3 Critical severity
ABP and AES: Uncontrolled Search Path Element
When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the service. Upon service restart, the malicious DLL is loaded and executed under the L
- 9.2 Critical severity
ABP and AES: Unquoted Search Path or Element
The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the serv
- 7.1 High severity
ADM: Improper Authentication
An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server file system into their own EZSync folder. The vulnerability is due to a lack of authorization checks on t
- 8.1 High severity
ADM: Improper Limitation of a Pathname to a Restricted Directory
Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61
- 8.8 High severity
ADM: Improper Limitation of a Pathname to a Restricted Directory
Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61
- 8.8 High severity
ADM: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM) allows remote unauthorized users to execute arbitrary commands via unspecified vectors. Affected pro
- 10.0 Critical severity
ADM: Improper Limitation of a Pathname to a Restricted Directory
EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.
- 7.5 High severity
Download Center: Incorrect Default Permissions
Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and a
- 9.8 Critical severity
ADM: Out-of-bounds Write
A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation. An attacker can exploit this vulnerability to execute arbitrary code. Affected ADM versions include: 4.0.6.REG2, 4.1.0 and below as
- 8.8 High severity
ADM: Out-of-bounds Write
A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can exploit this vulnerability to run arbitrary code. Affected ADM versions include: 3.5.9.RUE3 and below, 4.0.5.RVI1 and be