CVE-2026-67248 | High | 8.8 | 2026-07-30 | A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly v… |
CVE-2026-67247 | Medium | 6.5 | 2026-07-30 | A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently… |
CVE-2026-67246 | Medium | 6.5 | 2026-07-30 | A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not suffic… |
CVE-2026-67245 | High | 8.1 | 2026-07-30 | A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficie… |
CVE-2026-67244 | High | 7.2 | 2026-07-30 | A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration… |
CVE-2026-18188 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data… |
CVE-2026-18187 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an er… |
CVE-2026-18186 | High | 8.1 | 2026-07-30 | A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be… |
CVE-2026-6644 | Critical | 9.1 | 2026-04-20 | A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted… |
CVE-2026-6643 | Critical | 9.9 | 2026-04-20 | A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-contro… |
CVE-2026-3179 | High | 8.1 | 2026-02-25 | The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacke… |
CVE-2026-3100 | Medium | 6.5 | 2026-02-25 | The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper valid… |
CVE-2026-24936 | Critical | 9.8 | 2026-02-03 | When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowin… |
CVE-2026-24935 | Medium | 5.6 | 2026-02-03 | A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services r… |
CVE-2026-24934 | Low | 3.7 | 2026-02-03 | The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP addres… |
CVE-2026-24933 | Medium | 5.9 | 2026-02-03 | The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificates validation vulner… |
CVE-2026-24932 | Medium | 5.9 | 2026-02-03 | The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improp… |
CVE-2025-13053 | Low | 3.7 | 2025-12-12 | When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept n… |
CVE-2025-13052 | Medium | 5.9 | 2025-12-12 | When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can… |
CVE-2025-13051 | | | 2025-11-19 | When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as… |
CVE-2025-8070 | | | 2025-07-23 | The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary… |
CVE-2025-7699 | | | 2025-07-16 | An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server fil… |
CVE-2025-7618 | | | 2025-07-14 | A stored Cross-Site Scripting (XSS) vulnerability vulnerability was found in the File Explorer and Text Editor of ADM. An attacker could exploit this vulnerabi… |
CVE-2025-7380 | | | 2025-07-14 | A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to inject malicious scripts into the folder… |
CVE-2025-7379 | | | 2025-07-09 | A security bypass vulnerability allows exploitation via Reverse Tabnabbing, a type of phishing attack where attackers can manipulate the content of the origina… |
CVE-2025-7378 | | | 2025-07-09 | An improper Input Validation vulnerability allows injecting arbitrary values of the NAS configuration file in ASUSTOR ADM. This could potentially lead to syste… |
CVE-2023-4475 | High | 7.5 | 2023-08-22 | An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to uninte… |
CVE-2023-3699 | High | 8.7 | 2023-08-22 | An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configur… |
CVE-2023-3698 | High | 8.5 | 2023-08-17 | Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and delete fil… |
CVE-2023-3697 | High | 8.5 | 2023-08-17 | Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create fil… |
CVE-2023-2910 | High | 8.8 | 2023-08-17 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM)… |
CVE-2023-2909 | High | 8.5 | 2023-05-31 | EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected prod… |
CVE-2023-2749 | High | 8.6 | 2023-05-31 | Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensiti… |
CVE-2023-2509 | High | 7.1 | 2023-05-17 | A Cross-Site Scripting(XSS) vulnerability was found on ADM, LooksGood and SoundsGood Apps. An attacker can exploit this vulnerability to inject malicious scrip… |
CVE-2023-30770 | High | 7.1 | 2023-04-17 | A stack-based buffer overflow vulnerability was found in the ASUSTOR Data Master (ADM) due to the lack of data size validation. An attacker can exploit this vu… |
CVE-2022-37398 | High | 7.1 | 2022-08-05 | A stack-based buffer overflow vulnerability was found inside ADM when using WebDAV due to the lack of data size validation. An attacker can exploit this vulner… |
CVE-2019-11689 | High | 8.1 | 2020-03-18 | An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server… |
CVE-2019-11688 | High | 7.4 | 2020-03-18 | An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any certificate for asusto… |
CVE-2018-12319 | High | 7.5 | 2018-12-04 | Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title. |
CVE-2018-12318 | High | 8.8 | 2018-12-04 | Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext. |
CVE-2018-12317 | High | 8.8 | 2018-12-04 | OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter. |
CVE-2018-12316 | High | 8.8 | 2018-12-04 | OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter. |
CVE-2018-12315 | Medium | 6.5 | 2018-12-04 | Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password. |
CVE-2018-12314 | High | 7.5 | 2018-12-04 | Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder"… |
CVE-2018-12313 | Critical | 9.8 | 2018-12-04 | OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL para… |
CVE-2018-12312 | High | 8.8 | 2018-12-04 | OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter. |
CVE-2018-12311 | Medium | 5.4 | 2018-12-04 | Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a ma… |
CVE-2018-12310 | Medium | 5.4 | 2018-12-04 | Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature. |
CVE-2018-12309 | High | 7.5 | 2018-12-04 | Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter… |
CVE-2018-12308 | Medium | 6.5 | 2018-12-04 | Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt_key" URL parameter. |
CVE-2018-12307 | High | 8.8 | 2018-12-04 | OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter. |
CVE-2018-12306 | High | 7.5 | 2018-12-04 | Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar is… |
CVE-2018-12305 | Medium | 6.1 | 2018-12-04 | Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript. |
CVE-2018-15699 | Medium | 6.1 | 2018-08-27 | ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. A man in the middle can take advantage of this by… |
CVE-2018-15698 | Medium | 6.5 | 2018-08-27 | ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing the full path to lo… |
CVE-2018-15697 | Medium | 6.5 | 2018-08-27 | ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full path. For example, /… |
CVE-2018-15696 | Medium | 4.3 | 2018-08-27 | ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi. |
CVE-2018-15695 | Medium | 6.5 | 2018-08-27 | ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path traversal vulnerab… |
CVE-2018-15694 | High | 7.5 | 2018-08-27 | ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a path traversal vulnera… |
CVE-2018-11511 | Critical | 9.8 | 2018-08-16 | The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope'… |
CVE-2018-11509 | Critical | 9.8 | 2018-08-16 | ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online… |
CVE-2018-11510 | Critical | 9.8 | 2018-06-28 | The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding… |
CVE-2018-11346 | Medium | 4.3 | 2018-05-22 | An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "download_sys_settings"… |
CVE-2018-11345 | High | 8.8 | 2018-05-22 | An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data via the POST parameter filen… |
CVE-2018-11344 | Medium | 6.5 | 2018-05-22 | A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a file on the system to download via t… |
CVE-2018-11343 | Medium | 5.4 | 2018-05-22 | A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross site scripting payl… |
CVE-2018-11342 | Medium | 4.3 | 2018-05-22 | A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to… |
CVE-2018-11341 | High | 7.2 | 2018-05-22 | Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via the filename parameter. |
CVE-2018-11340 | High | 7.2 | 2018-05-22 | An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename… |