Asustor Data Master
45 CVEs affecting Asustor Data Master. Latest disclosed: 2026-07-30. Critical: 4, High: 22.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6643 | Critical | 9.9 | 2026-04-20 | A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-contro… |
CVE-2026-24936 | Critical | 9.8 | 2026-02-03 | When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowin… |
CVE-2018-12313 | Critical | 9.8 | 2018-12-04 | OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL para… |
CVE-2026-6644 | Critical | 9.1 | 2026-04-20 | A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted… |
CVE-2026-67248 | High | 8.8 | 2026-07-30 | A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly v… |
CVE-2023-2910 | High | 8.8 | 2023-08-17 | Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM)… |
CVE-2018-12318 | High | 8.8 | 2018-12-04 | Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext. |
CVE-2018-12317 | High | 8.8 | 2018-12-04 | OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter. |
CVE-2018-12316 | High | 8.8 | 2018-12-04 | OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter. |
CVE-2018-12312 | High | 8.8 | 2018-12-04 | OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter. |
CVE-2018-12307 | High | 8.8 | 2018-12-04 | OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter. |
CVE-2023-3699 | High | 8.7 | 2023-08-22 | An Improper Privilege Management vulnerability was found in ASUSTOR Data Master (ADM) allows an unprivileged local users to modify the storage devices configur… |
CVE-2023-3698 | High | 8.5 | 2023-08-17 | Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and delete fil… |
CVE-2023-3697 | High | 8.5 | 2023-08-17 | Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create fil… |
CVE-2026-67245 | High | 8.1 | 2026-07-30 | A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficie… |
CVE-2026-18188 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data… |
CVE-2026-18187 | High | 8.1 | 2026-07-30 | A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an er… |
CVE-2026-18186 | High | 8.1 | 2026-07-30 | A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be… |
CVE-2026-3179 | High | 8.1 | 2026-02-25 | The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacke… |
CVE-2023-4475 | High | 7.5 | 2023-08-22 | An Arbitrary File Movement vulnerability was found in ASUSTOR Data Master (ADM) allows an attacker to exploit the file renaming feature to move files to uninte… |