CVE Intelligence
Analysis AI-assisted

CVE-2026-24936: ASUSTOR ADM: Improper Input Validation in CGI Program Allows Arbitrary File Write

ASUSTOR Data Master (ADM) contains an improper input validation flaw in a CGI program that is reachable when a specific function is enabled while joining an AD domain. The record states that an unauthenticated remote attacker could write arbitrary data to any file, and NVD rates the issue 9.8 (Critical) under CVSS 3.1. No confirmed exploitation appears in the sources consulted, and the record does not list a fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

ASUSTOR has published an advisory for CVE-2026-24936, a vulnerability in ASUSTOR Data Master (ADM) classified as improper input validation (CWE-20). According to the record, it involves a CGI program and is triggered when a specific function is enabled while joining an Active Directory domain from ADM. Details are in the vendor advisory.

Impact

  • The record describes an unauthenticated remote attacker able to write arbitrary data to any file on the system.
  • The description states that overwriting critical system files could lead to complete system compromise.
  • NVD scores the issue 9.8 (CVSS 3.1, Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CNA reports 9.5 under CVSS 4.0.

Affected products and versions

  • Product: Asustor Data Master (ADM).
  • The affected field lists the range from 4.1.0.rhu2 up to and including 4.3.3.rof1, and from 5.0.0.ra82 below 5.1.2.re51.
  • The description text refers to 4.1.0 through 4.3.3.ROF1 and 5.0.0 through 5.1.1.RCI1. The two statements differ on the upper bound of the 5.x branch, so the vendor advisory should be checked for the authoritative list.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog, and no EPSS score is available.
  • No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Review the vendor advisory and update ADM to a build outside the affected ranges. The record does not name a specific fixed version.
  • Until patched, avoid enabling the AD domain join function on affected systems if it is not required.
  • Restrict access to ADM management interfaces to trusted networks and limit their exposure.

Detection guidance

  • Review web server and CGI access logs for unexpected requests to management endpoints, especially around AD domain join operations.
  • Monitor for unexpected changes to system and configuration files and for unexplained service behavior.
  • Verify the installed ADM version against the vendor advisory.

Limitations of the available information

  • The record does not identify the specific CGI program, the exact function involved, or a fixed version.
  • The version boundaries conflict between the description text and the affected field.
  • EPSS and SSVC data are unavailable.

Frequently asked questions

What is CVE-2026-24936?

It is a critical improper input validation vulnerability in a CGI program of ASUSTOR Data Master (ADM). The record says it can let an unauthenticated remote attacker write arbitrary data to any file when a specific function is enabled while joining an AD domain.

Is this CVE being exploited in the wild?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted for this analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.