Asustor vulnerabilities
38 CVEs and advisories name Asustor as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-105324An HTTP header injection vulnerability was found in the ADM
- CVE-2026-18759An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.
- CVE-2026-67248A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM
- CVE-2026-67247A path traversal vulnerability was found in the IHM Log handling of ADM
- CVE-2026-67246A path traversal vulnerability was found in the Wallpaper component of ADM
- CVE-2026-67245A path traversal vulnerability was found in the VPN Clients on the ADM
- CVE-2026-67244A format string vulnerability was found in the Notification OAuth settings of ADM
- CVE-2026-18188A format string vulnerability was found in the Rsync Backup on the ADM
- CVE-2026-18187A format string vulnerability was found in the Internal Backup on the ADM
- CVE-2026-18186A stored format string vulnerability was found in the FTP Backup on the ADM
- CVE-2026-6644A command injection vulnerability was found in the PPTP VPN Clients on the ADM
- CVE-2026-6643A stack-based buffer overflow vulnerability in the VPN Clients on the ADM
- CVE-2026-3179A path traversal vulnerability was found in the FTP Backup on the ADM.
- CVE-2026-3100An improper certificate validation vulnerability was found in the FTP Backup on the ADM.
- CVE-2026-24936An improper input validation vulnerability was found in ADM while joining a AD Domain.
- CVE-2026-24935An improper certificate validation vulnerability was found in a third-party NAT traversal module.
- CVE-2026-24934An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address.
- CVE-2026-24933An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server.
- CVE-2026-24932An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.
- CVE-2025-13053A missing encryption of sensitive data vulnerability was found in the UPS settings of ADM
- CVE-2025-13052An improper certificates validation vulnerability was found in the Notification settings of ADM
- CVE-2025-13051Windows service used an uncontrolled search path element will cause unauthorized code execution with localsystem privileges
- CVE-2025-8070Windows service registered with an unquoted ImagePath vulnerability in the system registry
- CVE-2025-7699An improper access control vulnerability was found in the EZ Sync Manager of ADM
- CVE-2025-7618A stored Cross-Site Scripting (XSS) vulnerability exists in the File Explorer and Text Editor of ADM
- CVE-2025-7380A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM
- CVE-2025-7379A security bypass vulnerability was found in DataSync Center installed on ADM
- CVE-2025-7378An improper input validation vulnerability was found on manipulating configuration of ADM
- CVE-2023-4475An Arbitrary File Movement vulnerability was found on the ADM
- CVE-2023-3699An Improper Privilege Management vulnerability was found on the ADM