ASUSTOR1

Latest CVEs · RSS

• CVE-2026-105324 2026-10-07 · CVSS 9.2
  An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By
• CVE-2026-18759 2026-08-04 · CVSS 8.5
  The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryp
• CVE-2026-67248 2026-07-30 · CVSS 8.7
  A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly va
• CVE-2026-67247 2026-07-30 · CVSS 7.1
  A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently
• CVE-2026-67246 2026-07-30 · CVSS 6.9
  A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not suffici
• CVE-2026-67245 2026-07-30 · CVSS 7.0
  A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficien
• CVE-2026-67244 2026-07-30 · CVSS 8.6
  A format string vulnerability was found in the Notification OAuth settings of ADM. The vulnerability occurs because user-controlled notification configuration i
• CVE-2026-18188 2026-07-30 · CVSS 7.1
  A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data
• CVE-2026-18187 2026-07-30 · CVSS 7.1
  A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an err
• CVE-2026-18186 2026-07-30 · CVSS 7.1
  A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be w
• CVE-2026-6644 2026-04-20 · CVSS 9.4
  A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out of the restricted w
• CVE-2026-6643 2026-04-20 · CVSS 8.6
  A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and passing user-control
• CVE-2026-3179 2026-02-25 · CVSS 9.2
  The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker
• CVE-2026-3100 2026-02-25 · CVSS 8.3
  The FTP Backup on the ADM will not properly strictly enforce TLS certificate verification while connecting to an FTP server using FTPES/FTPS. An improper valida
• CVE-2026-24936 2026-02-03 · CVSS 9.5
  When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing
• CVE-2026-24935 2026-02-03 · CVSS 6.3
  A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services re
• CVE-2026-24934 2026-02-03 · CVSS 6.3
  The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address
• CVE-2026-24933 2026-02-03 · CVSS 8.9
  The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificates validation vulnera
• CVE-2026-24932 2026-02-03 · CVSS 8.9
  The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an imprope
• CVE-2025-13053 2025-12-12 · CVSS 7.0
  When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept ne
• CVE-2025-13052 2025-12-12 · CVSS 7.0
  When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can i
• CVE-2025-13051 2025-11-19 · CVSS 9.3
  When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as o
• CVE-2025-8070 2025-07-23 · CVSS 9.2
  The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary
• CVE-2025-7699 2025-07-16 · CVSS 7.1
  An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server file
• CVE-2025-7618 2025-07-14 · CVSS 4.8
  A stored Cross-Site Scripting (XSS) vulnerability vulnerability was found in the File Explorer and Text Editor of ADM. An attacker could exploit this vulnerabil