CVE-2026-24936criticalCWE-20

CVE-2026-24936: falha crítica em ASUSTOR ADM

An improper input validation vulnerability was found in ADM while joining a AD Domain.

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ADM

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.5epss 0.8%
When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.ROF1 as well as from ADM 5.0.0 through ADM 5.1.1.RCI1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
ASUSTOR · ADM
CVEs relacionadas — ASUSTOR ADM

No mesmo produto, das mais perigosas para as menos.

CVE-2023-2910HIGHA Command injection vulnerability was found on Printer service of ADMEPSS 1.6%CVE-2022-37398HIGHA stack-based buffer overflow vulnerability was found on ADMEPSS 0.7%CVE-2023-2909HIGHA Directory traversal vulnerability was found on EZ Sync service of ADMEPSS 0.7%CVE-2023-3697HIGHA Command injection vulnerability was found on Printer service of ADMEPSS 0.7%CVE-2023-3698HIGHA Command injection vulnerability was found on Printer service of ADMEPSS 0.6%CVE-2023-30770HIGHA stack-based buffer overflow vulnerability was found in the ADMEPSS 0.6%