CVE-2026-24936

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24936", "assignerOrgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77", "state": "PUBLISHED", "assignerShortName": "ASUSTOR1", "dateReserved": "2026-01-28T08:40:24.462Z", "datePublished": "2026-02-03T03:50:18.773Z", "dateUpdated": "2026-02-04T16:12:51.388Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "AD Domain", "platforms": ["Linux", "x86", "64 bit", "ARM"], "product": "ADM", "vendor": "ASUSTOR", "versions": [{"lessThanOrEqual": "4.3.3.ROF1", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThanOrEqual": "5.1.1.RCI1", "status": "affected", "version": "5.0.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Wilson Lu (@93wilsonlu), working with DEVCORE Internship Program"}], "datePublic": "2026-02-03T03:50:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise.<br><p>Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.</p>"}], "value": "When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1."}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 9.5, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77", "shortName": "ASUSTOR1", "dateUpdated": "2026-02-03T04:20:19.018Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.asustor.com/security/security_advisory_detail?id=51"}], "source": {"discovery": "UNKNOWN"}, "title": "An improper input validation vulnerability was found in ADM while joining a AD Domain.", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T16:12:40.079314Z", "id": "CVE-2026-24936", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:12:51.388Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24936", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-04T16:12:40.079314Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:12:46.572Z"}}], "cna": {"title": "An improper input validation vulnerability was found in ADM while joining a AD Domain.", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Wilson Lu (@93wilsonlu), working with DEVCORE Internship Program"}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASUSTOR", "product": "ADM", "versions": [{"status": "affected", "version": "4.1.0", "versionType": "custom", "lessThanOrEqual": "4.3.3.ROF1"}, {"status": "affected", "version": "5.0.0", "versionType": "custom", "lessThanOrEqual": "5.1.1.RCI1"}], "platforms": ["Linux", "x86", "64 bit", "ARM"], "packageName": "AD Domain", "defaultStatus": "unaffected"}], "datePublic": "2026-02-03T03:50:00.000Z", "references": [{"url": "https://www.asustor.com/security/security_advisory_detail?id=51", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.", "supportingMedia": [{"type": "text/html", "value": "When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise.<br><p>Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77", "shortName": "ASUSTOR1", "dateUpdated": "2026-02-03T04:20:19.018Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24936", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:12:51.388Z", "dateReserved": "2026-01-28T08:40:24.462Z", "assignerOrgId": "f35eaae9-79f2-4d0d-a5c7-7bea6ed6be77", "datePublished": "2026-02-03T03:50:18.773Z", "assignerShortName": "ASUSTOR1"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "AD Domain", "platforms": ["Linux", "x86", "64 bit", "ARM"], "product": "ADM", "vendor": "ASUSTOR", "versions": [{"lessThanOrEqual": "4.3.3.ROF1", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThanOrEqual": "5.1.1.RCI1", "status": "affected", "version": "5.0.0", "versionType": "custom"}]}], "source": "security@asustor.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*", "matchCriteriaId": "662E4EA5-0C53-4669-947E-705E5E076B10", "versionEndIncluding": "4.3.3.rof1", "versionStartIncluding": "4.1.0.rhu2", "vulnerable": true}, {"criteria": "cpe:2.3:o:asustor:data_master:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FC466AD-33C6-4F5C-A679-C5100B0B9B32", "versionEndExcluding": "5.1.2.re51", "versionStartIncluding": "5.0.0.ra82", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise.\nAffected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1."}, {"lang": "es", "value": "Cuando una funci\u00f3n espec\u00edfica est\u00e1 habilitada al unirse a un Dominio AD desde ADM, una vulnerabilidad de validaci\u00f3n de par\u00e1metros de entrada incorrecta en un programa CGI espec\u00edfico permite a un atacante remoto no autenticado escribir datos arbitrarios en cualquier archivo del sistema. Al explotar esta vulnerabilidad, los atacantes pueden sobrescribir archivos cr\u00edticos del sistema, lo que lleva a un compromiso completo del sistema.\nLos productos y versiones afectados incluyen: desde ADM 4.1.0 hasta ADM 4.3.3.ROF1, as\u00ed como desde ADM 5.0.0 hasta ADM 5.1.1.RCI1."}], "id": "CVE-2026-24936", "lastModified": "2026-06-17T10:23:50.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.5, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@asustor.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24936", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T16:12:40.079314Z", "version": "2.0.3"}}]}, "published": "2026-02-03T04:15:56.357", "references": [{"source": "security@asustor.com", "tags": ["Vendor Advisory"], "url": "https://www.asustor.com/security/security_advisory_detail?id=51"}], "sourceIdentifier": "security@asustor.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@asustor.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:26:13.783515+00:00", "value": {"mitigation_remediation": ["Deploy the latest firmware that incorporates the fix for the unauthenticated file overwrite vulnerability, ensuring the ADM component is updated to a version newer than 5.1.1.RCI1.", "Restrict access to the ADM management interface by limiting it to trusted internal networks and enforcing strong authentication where possible.", "If an upgrade cannot be performed immediately, disable the AD Domain join functionality in ADM or restrict the CGI that handles that operation, and enable verbose logging to detect any unauthorized file write attempts."], "summary": {"action": "Apply Fix", "impact": "Arbitrary file overwrite leading to system compromise"}, "threat_synthesis": {"affected_systems": "Products affected are ASUSTOR Advanced Data Master (ADM) versions 4.1.0 through 4.3.3.ROF1 and 5.0.0 through 5.1.1.RCI1. These include the Data Master operating system shipped with ASUSTOR NAS devices and any installation that uses the vulnerable ADM versions listed.", "description_and_impact": "The vulnerability stems from improper input validation in a CGI program that is triggered when a particular function is enabled during an AD Domain join operation in ADM. An attacker who can reach the ADM interface without authentication can supply crafted input, causing the CGI to write arbitrary data to any file on the underlying system. This allows overwriting critical system files, essentially granting full control over the NAS and leading to a complete system compromise. The weakness corresponds to CWE\u201120: Improper Input Validation.", "risk_and_exploitability": "The CVSS score of 9.5 reflects the high severity of the flaw. Although the EPSS score is below 1%, indicating a low current likelihood of exploitation, the vulnerability remains a critical risk because it can be abused remotely without authentication and the attacker does not need to perform any privilege escalation before the file overwrite occurs. The vulnerability is not listed in the CISA KEV catalog, but its potential for complete system compromise warrants immediate attention. The attack requires remote connectivity to the ADM management interface and activation of the vulnerable function during AD Domain join, after which the attacker can write to any file."}}}}, "created": "2026-02-04T12:13:58.787644+00:00", "updated": "2026-04-18T00:30:25.714350+00:00", "vendors": ["asustor", "asustor$PRODUCT$adm"]}